Fortune 500 Global Manufacturer: Replacing an MSSP with an agentic SOC on every alert

The problem

This Fortune 500 manufacturer supplies systems and components to automakers worldwide, with plants and offices across the Americas, Europe and Asia. Its security operations team protects that footprint with a best-of-breed stack built around CrowdStrike, with Microsoft Entra ID, Microsoft Defender and Abnormal covering identity, endpoint and email.

The team had real strengths: experienced analysts, deep technical skill and a working knowledge of the environment that no outside provider could match. The pressure came from everywhere else. New alerts arrived every day, risk kept growing, and SLA and regulatory obligations left no room for a slow response. Hiring could not scale to match the threat volume on its own.

The team relied on an MSSP for round-the-clock coverage and decided to replace it. Whatever came next had to deliver 24/7/365 triage with no gaps in monitoring, and any real concern had to trigger an immediate escalation.

It also had to respect three principles. It had to work with the tools the team already ran, because the team was not going to rebuild its ecosystem. It had to understand the company's data, drawing on historical activity for context, because investigations depend on knowing what happened before. And it had to stay flexible enough to connect new tools as the stack and the business grew.

Volume made the stakes clear. Across a 60-day window, the environment produced alerts at a pace of roughly 136,000 a year, most of them from CrowdStrike. Working them by hand would take more than 15,000 analyst hours a year.

The solution

Agents take the first pass on every alert

The company deployed Prophet AI SOC Analyst as its first line, investigating alerts from CrowdStrike, Microsoft Entra ID, Microsoft Defender for Endpoint, Microsoft Defender and Abnormal around the clock. Each alert gets a full investigation that queries the connected sources in place, draws on historical data and ends in a determination with the evidence behind it. Suppression rules close known-benign alert types before they need an investigation. Malicious findings escalate to the team right away, and Agent Actions are taking on response steps such as host containment and session revocation, with the approvals the team chose. The team teaches Prophet AI its environment through guidance, and every analyst benefits from it.

The results

~11 analyst years of alert work handled each year

Projected from 60 days, Prophet AI handles roughly 136,000 alerts a year: about 16,200 full investigations and about 120,000 alerts closed by suppression rules. Done by hand, that work would take about 20 minutes per investigation and 5 minutes to confirm each known-benign alert, or about 15,400 hours a year. At 5.6 hours of hands-on investigation per analyst per day over 250 workdays, that is roughly 11 analyst years.

Suppression rules clear 88% of the queue

Suppression rules close 88% of incoming alerts, almost all from CrowdStrike, before they need an investigation. Confirming those by hand would take about 10,000 hours a year, roughly 7 analyst years, that no one now spends on known-benign activity. The remaining 12% are the alerts worth a full investigation, and each one gets it.

Every alert investigated in about 5 minutes

Across the 60-day window, Prophet AI's mean time to investigate was 5 minutes, against a manual baseline of about 20 minutes per alert. Each alert is worked the moment it lands, around the clock, so the queue does not pile up overnight or over a weekend.

Only the alerts that need a person reach one

About 94% of investigations end in a benign determination, with the evidence attached. The rest reach the team already investigated: 500 to 600 malicious findings a year at the current pace. Analysts spend their time on response, detection tuning and threat hunting.