The brief
An NBFC lending across three states had grown from a single office to a distributed team faster than its IT cover had. Monitoring stopped at 7pm. Alerts from the endpoint tool went to a shared mailbox nobody owned overnight. When a lender ran diligence, the questions the NBFC could not answer were not about firewalls — they were about evidence: who was watching, what was logged, how quickly something would be caught.
What we found
- Endpoint protection installed on most machines, with no central console reporting which ones had fallen out of policy.
- Logs retained on the devices that generated them, so an incident would have destroyed its own evidence.
- No defined escalation path outside working hours.
- Email — the entry point for the sector’s most common attacks — filtered only by what the mail platform did by default.
What we put in place
The engagement was delivered under our Cybersecurity & SOC service, run as a managed function rather than a one-off hardening project.
- Round-the-clock monitoring. Security and network events centralised, with a defined severity ladder and a named escalation path at every hour of the day.
- Endpoint detection. Estate moved onto managed EDR / XDR, so a device that drifts out of policy raises an alert instead of going quiet.
- Email defence and retention. Filtering, and archiving that survives the mailbox, through Email Archiving & Security — the archive is what makes an audit answerable.
- Perimeter. Policy reviewed and standardised on managed appliances from our Firewall & Security practice.
- Recoverability. Backups brought under Disaster Recovery & Backup with tested restores, because detection without recovery only shortens the outage.
Results
The NBFC can now answer the diligence question directly: monitoring is continuous, alerts have owners, logs are retained away from the machines that wrote them, and restores are tested on a schedule. The security function stopped being a set of installed products and became a service with hours, owners and evidence.
Why BFSI asks for this
Financial services carry an obligation to demonstrate control, not merely to have it. Our BFSI practice is built around producing that evidence as a by-product of day-to-day operations.
Weighing this up? Our guide on what a SOC covers versus a NOC sets out what each one actually watches.
