{"id":25278,"date":"2025-02-18T20:00:00","date_gmt":"2025-02-19T04:00:00","guid":{"rendered":"https:\/\/www.sumologic.com\/?post_type=resource&p=25278"},"modified":"2026-03-18T13:50:44","modified_gmt":"2026-03-18T21:50:44","slug":"endowus","status":"publish","type":"resource","link":"https:\/\/www.sumologic.com\/case-studies\/endowus","title":{"rendered":"Endowus"},"content":{"rendered":"\n
<\/div>\n\n\n\n

Results at a glance<\/h3>\n\n\n\n
<\/path><\/svg>90% reduction in alert investigation time<\/span><\/div><\/div>\n\n\n\n
<\/path><\/svg>Detected and mitigated phishing incident early on before significant damage was done<\/span><\/div><\/div>\n\n\n\n
<\/path><\/svg>Eliminated alert fatigue and improved overall employee satisfaction by filtering out noise<\/span><\/div><\/div>\n\n\n\n
<\/path><\/svg>Greater visibility into cloud-native environments with deep, actionable insights<\/span><\/div><\/div>\n\n\n\n
<\/path><\/svg>Centralized security operations with a unified Cloud SIEM platform for better threat detection and response<\/span><\/div><\/div>\n\n\n\n
<\/div>\n\n\n\n

Challenge<\/h3>\n\n\n\n

Endowus needed to enhance its security posture, streamline tools, and reduce alert fatigue.<\/strong><\/h5>\n\n\n\n

When Endowus began building its security stack three years ago, it quickly experienced significant tool sprawl. With various security tools implemented, including email security and data loss prevention solutions, alerts flooded in from multiple sources, creating an overwhelming volume of pings and notifications. On top of that, the security team had to constantly monitor and fine-tune alerting systems across multiple dashboards, making security management complex and time-consuming.<\/p>\n\n\n\n

To regain visibility and improve efficiency, Endowus\u2019 Head of Information Security, Alvin Lim, was on the search for a Cloud SIEM solution that could unify its security tools into a single, centralized platform.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Solution<\/h3>\n\n\n\n

After speaking with three different logging solutions and conducting a proof of concept (POC) with two, they ultimately chose Sumo Logic for three key reasons: its ease of integration, maintenance, and advanced alert tuning. <\/p>\n\n\n\n

Easy integration with existing tools<\/strong><\/p>\n\n\n\n

Sumo Logic\u2019s cloud-native architecture made it simple for Endowus to integrate its key data sources, including AWS, SentinelOne, Google Workspace, and their secure web gateway. Unlike other vendors requiring complex setups and additional workarounds, Sumo Logic streamlined log ingestion and continuous visibility across their security environment. <\/p>\n\n\n\n

\u201cThe other vendor we evaluated wasn\u2019t cloud-native which meant more hoops to jump through to ingest log data properly. Ever since implementing Sumo Logic, integration has been seamless,\u201d Lim says.<\/p>\n\n\n\n

Alert tuning and reduced investigation time<\/strong><\/p>\n\n\n\n

Before Sumo Logic, the team was overwhelmed by alert fatigue and spent roughly an hour investigating each alert. Thinking about the days before implementing Sumo Logic, Lim says, \u201cWe\u2019d get flooded with alerts that we didn\u2019t know were actionable or not, which gave the team lots of anxiety as we didn\u2019t know if it needed to be escalated. With Sumo Logic, we have clear insights into what\u2019s happening, and our investigation time has dropped.\u201d<\/p>\n\n\n\n

Cloud-native flexibility and scalability<\/strong><\/p>\n\n\n\n

As a lean team of two engineers, Endowus needed a solution that was easy to manage without adding unnecessary overhead. Sumo Logic\u2019s intuitive Platform, out-of-the-box (OOTB) rules and automated rule maintenance meant that even team members without deep technical expertise could contribute to security operations.<\/p>\n\n\n\n

Strong ROI and justifiable investment<\/strong> <\/p>\n\n\n\n

For Endowus, cost-effectiveness was key to choosing the right security solution. Beyond features and capabilities, the ROI needed to be justifiable. Sumo Logic stood out not just for its comprehensive security offerings but also for its reasonable pricing compared to alternatives. <\/p>\n\n\n\n

Lim also leveraged Sumo Logic Flex Licensing, so his costs were based on insights and analytics volume rather than data ingestion to scale with his evolving needs. This flexibility allowed them to scale up or down as their use case changed and adapt to new requirements while keeping costs under control.<\/p>\n\n\n\n

\u201cBudgetary approvals for new tools can often be challenging. As security leaders, we must advocate for investments we believe in. Sumo Logic made logical sense as we could see the value of the service,\u201d Lim said.<\/p>\n\n\n\n

<\/div>\n\n\n
<\/div>
\n \"Alvin<\/figure><\/figure>

Alvin Lim<\/p>

Head of Information Security<\/p><\/div><\/div>

\u201cSumo Logic helps us accelerate impact by identifying impactful findings and showing us a clear path to investigation and remediation, all delivered through a streamlined, consolidated Cloud SIEM platform.\n\u201d<\/div><\/div>
\"Alvin<\/a><\/div><\/div><\/div><\/div><\/div>\n\n\n
<\/div>\n\n\n\n

Results<\/h3>\n\n\n\n

90% reduction in alert investigation time<\/strong><\/p>\n\n\n\n

With Sumo Logic Cloud SIEM, the Endowus team can quickly identify suspicious activities, reduce false positives, and ensure every alert is actionable. Before, they spent an hour investigating each individual alert. Now, benign alerts are resolved in just five to ten minutes, allowing the team to focus on real threats.<\/p>\n\n\n\n

Improved incident detection and response<\/strong><\/p>\n\n\n\n

By eliminating data silos, Endowus has a comprehensive view of their security landscape, helping them trace attack vectors and identify root causes of incidents.<\/p>\n\n\n\n

In one instance, Sumo Logic helped Endowus detect a phishing incident early on before it became impactful. By integrating data from Endowus\u2019 various tools, the team quickly identified suspicious behavior and mitigated the threat before it caused any significant damage. <\/p>\n\n\n\n

Reflecting on this incident, Lim notes: \u201cThanks to Sumo Logic, we detected the attack\u2019s source early and took action before any real harm was done. Plus, with all the additional tools we had ingesting into Sumo Logic, we also assessed the full extent of the damage and mitigated it quickly.\u201d<\/p>\n\n\n\n

Sumo Logic\u2019s user-friendly, game-like dashboard helps Endowus\u2019 security team easily track the progression of incidents and connect the dots between various data points. Even non-technical users can easily navigate the system, making investigations quicker and more efficient. <\/p>\n\n\n\n

Lim said, \u201cThe Sumo Logic Platform is visually appealing and responsive, making it easy to manage, process, and analyze large amounts of data. This minimizes lag, which can cause friction in the process. The entire Sumo Logic UI was super responsive, kept us engaged, and helped keep the momentum going.\u201d <\/p>\n\n\n\n

Customized alert management for tailored risk appetite<\/strong><\/p>\n\n\n\n

Endowus leverages Sumo Logic\u2019s customizable alert management features to align security monitoring with its unique needs better. By tweaking thresholds for different data sources, Endowus minimizes alert fatigue and ensures that alerts they receive are actionable and meaningful. <\/p>\n\n\n\n

Lim explains, \u201cWe wanted to be able to tweak thresholds for each tool and data source to align with our risk appetite. For example, we track user behavior in Google Drive to ensure teams can be flexible without compromising security. If a user downloads sensitive data excessively within a short period, we\u2019re alerted and can investigate immediately.\u201d <\/p>\n\n\n\n

In the future, Lim also hopes to explore Sumo Logic\u2019s UEBA and other AI-powered features to enhance their alert management with automation and AI. <\/p>\n\n\n\n

\u201cJust from adjusting the thresholds manually, we\u2019ve already seen improvement in alert quality. We\u2019re excited to explore the potential of Sumo Logic\u2019s AI features to make our process more efficient. These features will empower our security team to identify, resolve, and remediate potential threats. We want to ensure we increase our coverage and remediate sooner, and I\u2019m extremely happy to see that Sumo Logic is building out features like this to ensure we meet our goals.\u201d<\/p>\n\n\n\n

Increase in employee satisfaction<\/strong><\/p>\n\n\n\n

Overall, Endowus found that team satisfaction has increased since implementing Sumo Logic. Since the shift to Sumo Logic, Lim notices that security operations are more efficient and there\u2019s an increase in team morale. <\/p>\n\n\n\n

\u201cThere\u2019s less frustration,\u201d Lim said. \u201cBefore, we\u2019d have to look through six or seven alerts, with five of those being unhelpful. That\u2019s no longer the case with Sumo Logic. It\u2019s helped uplift the team, who are eager to explore the service\u2019s capabilities. It\u2019s empowering them to do their jobs better than before.\u201d<\/p>\n\n\n\n

Better visibility and peace of mind<\/strong><\/p>\n\n\n\n

Before adopting Sumo Logic, Endowus faced a significant challenge. They had a lack of visibility into AWS security alerts which made it difficult for the security team to conduct thorough investigations, and often, they felt a lingering sense of uncertainty.<\/p>\n\n\n\n

\u201cPreviously, we were overwhelmed,\u201d Lim recalled. \u201cMultiple alerts were coming in, and not being able to address them gave us a sense of unease. Even more worrying was the possibility that there were real threats slipping through that we couldn\u2019t detect.\u201d<\/p>\n\n\n\n

Sumo Logic changed everything. By piping AWS Cloudtrail logs into Cloud SIEM, Endowus has deeper visibility into security events without having to manually maintain complex rule sets. With Cloud SIEM automatically correlating alerts with security frameworks, like MITRE ATT&CK, Endowus receives actionable insights into what has occurred and what could potentially happen, along with remediation steps to mitigate risks. <\/p>\n\n\n\n

\u201cSumo Logic helps us accelerate impact by identifying impactful findings and showing us a clear path to investigation and remediation, all delivered through a streamlined, consolidated Cloud SIEM platform,\u201d said Lim.<\/p>\n\n\n\n

Simple onboarding and ongoing support<\/strong><\/p>\n\n\n\n

Despite having little prior experience with Sumo Logic, Endowus quickly ramped up with the support of Sumo Logic\u2019s customer success team. From the initial POC to full implementation, they benefited from hands-on support, in-person training, and Sumo Logic certification programs, helping them maximize Sumo Logic\u2019s full capabilities. <\/p>\n\n\n\n

He notes, \u201cWe started with little to no experience working with Sumo Logic, but it wasn\u2019t difficult for us to learn things with the support of Sumo Logic\u2019s customer success team. The customer success team acted as an extended version of our team, helping us fully get up to speed quickly.\u201d<\/p>\n\n\n\n

Lim highlighted that he recommends Sumo Logic to other security leaders for a variety of reasons, \u201cThe ROI with Sumo Logic is extremely high. You get value for every dollar you spend. More importantly, it provides peace of mind, knowing you have the ability to perform deep forensic investigations when needed. It\u2019s a powerful tool that helps you achieve your security goals. It\u2019s a well-valued tool with a full suite of features, Sumo Logic ensures that your key security success criteria are met.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

Results at a glance Challenge Endowus needed to enhance its security posture, streamline tools, and reduce alert fatigue. When Endowus began building its security stack three years ago, it quickly experienced significant tool sprawl. With various security tools implemented, including email security and data loss prevention solutions, alerts flooded in from multiple sources, creating an […]<\/p>\n","protected":false},"author":4,"featured_media":25289,"template":"","meta":{"_acf_changed":false,"show_custom_date":false,"custom_date":"","featured":false,"featured_image":0,"learn_more_label":"","image_alt_text":"","learn_more_type":"","show_popup":false,"learn_more_link_file":0,"event_date":false,"event_start_date":"","event_end_date":"","place_holder_image_url":"","post_reading_time":"6","notification_enabled":false,"notification_text":"","notification_logo":"","notification_expiration_time":0,"is_enable_transparent_header":false,"selected_taxonomy_terms":{"resource-type":[29],"resource-solution":[46],"translation_priority":[221]},"selected_primary_terms":{"resource-type":[],"resource-solution":[]},"learn_more_link":[],"featured_page_list":[],"notification_enabled_post_list":[],"_gspb_post_css":"#gspb_iconsList-id-gsbp-4a24fcd.gspb_iconsList .gspb_iconsList__item__text{margin-left:15px}#gspb_iconsList-id-gsbp-4a24fcd.gspb_iconsList .gspb_iconsList__item{display:flex;flex-direction:row;align-items:center;position:relative}#gspb_iconsList-id-gsbp-0bb5ad2.gspb_iconsList .gspb_iconsList__item svg path,#gspb_iconsList-id-gsbp-1d29c35.gspb_iconsList .gspb_iconsList__item svg path,#gspb_iconsList-id-gsbp-2b1a2e4.gspb_iconsList .gspb_iconsList__item svg path,#gspb_iconsList-id-gsbp-4a24fcd.gspb_iconsList .gspb_iconsList__item svg path,#gspb_iconsList-id-gsbp-a617356.gspb_iconsList .gspb_iconsList__item svg path{fill:#2184f9!important}#gspb_iconsList-id-gsbp-0bb5ad2.gspb_iconsList [data-id='0'] svg,#gspb_iconsList-id-gsbp-1d29c35.gspb_iconsList [data-id='0'] svg,#gspb_iconsList-id-gsbp-2b1a2e4.gspb_iconsList [data-id='0'] svg,#gspb_iconsList-id-gsbp-4a24fcd.gspb_iconsList [data-id='0'] svg,#gspb_iconsList-id-gsbp-a617356.gspb_iconsList [data-id='0'] svg,body #gspb_iconsList-id-gsbp-0bb5ad2.gspb_iconsList .gspb_iconsList__item img,body #gspb_iconsList-id-gsbp-0bb5ad2.gspb_iconsList .gspb_iconsList__item svg,body #gspb_iconsList-id-gsbp-1d29c35.gspb_iconsList .gspb_iconsList__item img,body #gspb_iconsList-id-gsbp-1d29c35.gspb_iconsList .gspb_iconsList__item svg,body #gspb_iconsList-id-gsbp-2b1a2e4.gspb_iconsList .gspb_iconsList__item img,body #gspb_iconsList-id-gsbp-2b1a2e4.gspb_iconsList .gspb_iconsList__item svg,body #gspb_iconsList-id-gsbp-4a24fcd.gspb_iconsList .gspb_iconsList__item img,body #gspb_iconsList-id-gsbp-4a24fcd.gspb_iconsList .gspb_iconsList__item svg,body #gspb_iconsList-id-gsbp-a617356.gspb_iconsList .gspb_iconsList__item img,body #gspb_iconsList-id-gsbp-a617356.gspb_iconsList .gspb_iconsList__item svg{margin:0!important}#gspb_iconsList-id-gsbp-0bb5ad2.gspb_iconsList .gspb_iconsList__item__text{margin-left:15px}#gspb_iconsList-id-gsbp-0bb5ad2.gspb_iconsList .gspb_iconsList__item{display:flex;flex-direction:row;align-items:center;position:relative}#gspb_iconsList-id-gsbp-a617356.gspb_iconsList .gspb_iconsList__item__text{margin-left:15px}#gspb_iconsList-id-gsbp-a617356.gspb_iconsList .gspb_iconsList__item{display:flex;flex-direction:row;align-items:center;position:relative}#gspb_iconsList-id-gsbp-1d29c35.gspb_iconsList .gspb_iconsList__item__text{margin-left:15px}#gspb_iconsList-id-gsbp-1d29c35.gspb_iconsList .gspb_iconsList__item{display:flex;flex-direction:row;align-items:center;position:relative}#gspb_iconsList-id-gsbp-2b1a2e4.gspb_iconsList .gspb_iconsList__item__text{margin-left:15px}#gspb_iconsList-id-gsbp-2b1a2e4.gspb_iconsList .gspb_iconsList__item{display:flex;flex-direction:row;align-items:center;position:relative}","_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"3185,3180,3170","_relevanssi_noindex_reason":"","inline_featured_image":false},"resource-type":[29],"resource-solution":[46],"class_list":["post-25278","resource","type-resource","status-publish","has-post-thumbnail","hentry","resource-type-case-studies","resource-solution-cloud-siem"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sumologic.com\/wp-json\/wp\/v2\/resource\/25278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sumologic.com\/wp-json\/wp\/v2\/resource"}],"about":[{"href":"https:\/\/www.sumologic.com\/wp-json\/wp\/v2\/types\/resource"}],"author":[{"embeddable":true,"href":"https:\/\/www.sumologic.com\/wp-json\/wp\/v2\/users\/4"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sumologic.com\/wp-json\/wp\/v2\/media\/25289"}],"wp:attachment":[{"href":"https:\/\/www.sumologic.com\/wp-json\/wp\/v2\/media?parent=25278"}],"wp:term":[{"taxonomy":"resource-type","embeddable":true,"href":"https:\/\/www.sumologic.com\/wp-json\/wp\/v2\/resource-type?post=25278"},{"taxonomy":"resource-solution","embeddable":true,"href":"https:\/\/www.sumologic.com\/wp-json\/wp\/v2\/resource-solution?post=25278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}