// Q&A CASE STUDY
‘Round-the-Clock’ Protection:
How RAM Safeguards its Data with KHIPU SOC.
In early 2024, the Royal Academy of Music partnered with KHIPU to provide ‘round the clock’ threat detection, response and protection across their busy campus environment. After almost 12 months of using KHIPU’s Security Operations Centre (SOC) services, we asked Sebastian Groves, Infrastructure and Cyber Security Manager at the academy, to share his views and experiences on how the SOC has performed amidst the ever-changing cyber threat landscape.
KHIPU: Since implementing the SOC service, what would you say has been the most significant outcome?
SG: The most significant outcome has been the enhanced visibility into activities happening within our network. Before implementing KHIPU’s SOC services, we were largely unaware of certain actions taking place, such as unusual behaviours like password changes at unconventional hours. Initially, we were overwhelmed by the number of alerts, but the SOC team helped refine these, allowing us to focus on meaningful insights. For instance, we discovered instances of team members adding users to critical security groups without a valid reason. When questioned, their actions were often casual, like “just testing.” These insights have been instrumental in identifying and addressing behaviours that could potentially introduce risks. The newfound visibility into these previously unnoticed activities has been transformative for our security posture.
KHIPU: How important is network visibility for ongoing cybersecurity?
SG: Network visibility is absolutely essential. Before implementing the SOC service, we often operated under assumptions, unaware of what was truly happening within our systems. Now, we receive timely alerts that bring critical activities to our attention. For example, the SOC has flagged incidents we might never have noticed otherwise, allowing us to take prompt action.
Fortunately, we’ve only encountered a couple of major alerts since going live with the SOC, where immediate action was required. Additionally, there was one instance where a user reported suspicious activity, which the SOC quickly investigated. Having this level of visibility means we can proactively address issues before they escalate, which has been a game-changer for our cybersecurity strategy.
“Network visibility is absolutely essential. Before implementing the SOC service, we often operated under assumptions, unaware of what was truly happening within our systems. Now, we receive timely alerts that bring critical activities to our attention.”
KHIPU: What is the most impactful feature of the SOC; something you couldn’t live without?
SG: The most impactful feature of the SOC is the detailed diagnostics provided for highseverity alerts, especially those triggered outside of regular hours. When something significant occurs, the SOC delivers a comprehensive breakdown of the issue, including what might have happened and additional context about the situation. This level of detail is invaluable—it allows us to assess whether immediate action is required or if the issue isn’t as severe as it initially appeared. It’s a real relief to have this clarity when receiving an alert late at night.
We’ve also recently implemented automation for isolating compromised devices. During working hours, if a high-severity alert is triggered, we receive an email prompting us to isolate the device with a single click using Microsoft Defender. Out of hours, this process is fully automated If a device is flagged as engaging in harmful activity, it will automatically be isolated to prevent further damage or lateral spread. Having this automation in place has been a game-changer. It gives us peace of mind knowing that any critical issues can be contained automatically, even if no one is immediately available to intervene. It’s a vital feature that ensures our network remains protected around the clock.
KHIPU: We often hear that a lack of cyber threat awareness from non-technical senior management can slow procurement. Is this something you have experienced?
SG: At the Royal Academy of Music, senior leadership’s openness to technical input has been crucial. We established a cybersecurity group for key stakeholders, including the Head of Finance. This, combined with the increasing awareness of cyber threats highlighted in the media, has fostered a strong understanding of cybersecurity risks among senior management.
To emphasise this need, I drew an analogy between the robust physical security measures in place for our valuable assets (like rare instruments) and the lack of equivalent protection for our IT infrastructure. This comparison effectively conveyed the critical need for 24/7 IT security and ultimately secured buy-in for a managed SOC service
KHIPU: Prior to opting for the KHIPU SOC, did you look at any other options? If so, what was the difference for you?
SG: “During our evaluation, we encountered providers with unclear pricing models, leading to unpredictable costs and the risk of unexpected expenses, particularly during incidents. This was a major concern, as we had previously experienced significant cost increases for minor logging activities. KHIPU’s SOC offered a compelling alternative with its fixed pricing model. This transparency and predictability were crucial factors in our decision. Furthermore, the inclusion of Google Chronicle provided a significant advantage. Unlike other solutions, Chronicle enabled us to directly search logs, not only for security events but also for operational troubleshooting. This added value proved invaluable.
KHIPU: did you ever consider recruiting for an in-house team instead of opting for a managed SOC Service?
SG: We initially considered building an in-house SOC, but quickly recognised the challenges. Staffing a 24/7/365 operation with highly skilled personnel would be difficult, especially given existing recruitment challenges. The risk of high staff turnover and the inevitable gaps in coverage during recruitment further discouraged this option. Building and maintaining an in-house SOC team would have required significant investment in staffing and resources, exceeding our current capacity. While we generally prefer to handle IT functions internally, the specialized skills and continuous monitoring required for a SOC made outsourcing the most practical and cost-effective solution.
KHIPU: How do you see the cybersecurity landscape for the education sector evolving over the next few years?
SG: I believe the future will continue to involve striking a balance between in-house capabilities and leveraging third-party expertise. In education, IT teams often wear many hats, making it difficult to maintain the specialist skills required for advanced cybersecurity. Rather than fully outsourcing, I see a trend toward third-party providers acting as extensions of internal teams. I expect this hybrid model—where third parties provide specialised support while still being integrated with internal operations—will become the norm in the education sector.
KHIPU: In terms of cybersecurity, what’s next for you and the team at RAM?
SG: Our next steps involve aligning more closely with established frameworks like NIST and working towards certifications such as Cyber Essentials. Up to now, our approach has been guided by our own knowledge and intuition, but adopting structured frameworks will ensure we don’t overlook critical details. Automation will also play a significant role in our future. We’re exploring tools like Cortex, which can enhance threat response efficiency.
For instance, staff could forward suspected phishing emails to a Cortex address, which would analyse the message and automatically remove it from all inboxes if confirmed malicious. This approach not only improves response times but also empowers staff to contribute to cybersecurity efforts, reducing the workload on our core team. Automation and structured guidance are key areas for our evolution.
“I believe the future will continue to involve striking a balance between in-house capabilities and leveraging third-party expertise. In education, IT teams often wear many hats, making it difficult to maintain the specialist skills required for advanced cybersecurity.”
“During our evaluation, we encountered providers with unclear pricing models, leading to unpredictable costs and the risk of unexpected expenses, particularly during incidents. This was a major concern, as we had previously experienced significant cost increases for minor logging activities. KHIPU’s SOC offered a compelling alternative with its fixed pricing model. This transparency and predictability were crucial factors in our decision.”
Sebastian Groves
Infrastructure & Cyber Security Manager
// Case Studies
You may also like.
Loretto School
SOC in a Box
In this Q&A case study discover how Loretto School re-evaluated their cybersecurity strategy, and implemented KHIPU Networks SOC in a Box.
Royal Central School of Speech & Drama
Network Infrastructure - Firewalls - NOC
In this Q&A case study, Charles Bermudez, Deputy Director of IT at RCSSD shares their journey, from identifying critical needs to the selection and implementation of cutting-edge solutions from HPE Aruba Networking and Palo Alto Networks, all supported around the clock by the expertise of KHIPU’s Network Operations Centre (NOC).
Canterbury Christ Church University
SOC Services
Canterbury Christ Church University implements KHIPU’s SOC to provide 24x7x365 visibility and protection against Cyber Threats. Canterbury Christ Church University, in partnership with KHIPU, transforms and leverages existing security tools into a 24x7x365 Security Operations Centre (SOC) protected environment with sector-wide immediate response, remediation and proactive threat hunting capabilities.
Liverpool John Moores University
Palo Alto Networks Firewall Infrastructure Upgrade
When their existing firewall infrastructure reached its end of life, LJMU seized the opportunity not just to upgrade, but to fundamentally enhance their security posture. This case study details how they improved their security posture, streamlined policy management, and enhanced their VPN capabilities. Discover the tangible benefits of a modern approach to network security in higher education.
TEC Partnership
SOC
TEC Partnership, one of England’s largest providers of further and higher education, faced the challenge of securing a vast and complex network spanning multiple campuses. With limited resources and disparate security systems, they were vulnerable to cyber threats. By deploying KHIPU’s SOC services, TEC Partnership embarked on a journey to transform their cybersecurity posture.
Barton Peveril Sixth Form College
SOC
After almost 6 months of using KHIPU's Security Operations Centre (SOC) services, we asked Charlie Davis, IT Manager at Barton Peveril to share his views and experiences on how the SOC was performing amidst the ever-changing cyber threat landscape.
Royal Academy of Music
SOC
After almost 12 months of using KHIPU’s Security Operations Centre (SOC) services, we asked Sebastian Groves, Infrastructure and Cyber Security Manager at the academy, to share his views and experiences on how the SOC has performed amidst the ever-changing cyber threat landscape.
Weston College
KHIPU Managed Firewall Services
Weston College, a leading educational institution serving nearly 30,000 learners across the country, faces the daily challenge of securing a vast and complex network. With three main campuses, numerous satellite centres, and over 4,000 devices connected, the College's IT team, led by Head of IT Kerrie Monk, must ensure the smooth operation of critical systems while safeguarding sensitive student and staff data.
Barton Peveril Sixth Form College
HPE Aruba Networking - Palo Alto Networks
Largest Sixth Form College in the UK accelerates connectivity & cyber security with KHIPU, HPE Aruba Networking & Palo Alto Networks solution. Like the majority of further- and higher education institutions, Barton Peveril Sixth Form College is facing a common set of networking and cyber security challenges. With students and staff members each accessing the network via an increasing number of devices, in addition to those
University of Witwatersrand (Wits)
Palo Alto Networks Cortex
In response to escalating cyber threats, University of the Witwatersrand needed a comprehensive cybersecurity solution to protect its extensive network of 41,000 students and staff. Partnering with KHIPU Networks and Palo Alto Networks, Wits implemented the advanced Cortex XDR and XSOAR platform. This unified system delivers extended protection, detection, and response capabilities across the university's network, ensuring the safety of its entire community.
University of Sunderland
Palo Alto Networks Prisma Access
In the wake of a significant cyberattack, the University of Sunderland needed to rapidly review its cybersecurity strategy. A change came in the form of Palo Alto Networks and KHIPU Networks. A single, unified network security and secure access service edge (SASE) platform strategy is helping to secure the University’s technical security integrity - and its future.
The King Alfred School
HPE Aruba Secure Campus Network
The King Alfred School (KAS) is a leading Co-Educational Independent Day School dedicated to fostering a vibrant learning environment for students aged 4-18. With so many pupils, ensuring a seamless educational experience in today’s technology-driven world presented a unique challenge for the school’s IT team.
Sheffield Hallam University
SOC Services
A single, unified KHIPU and Palo Alto Networks endpoint and network security solution including Next Generation Firewalls and KHIPU'S 24x7 SOC. Solution: Next-Generation Firewalls, Cortex XDR, Cortex XSOAR, and Panorama; KHIPU SOC
Loretto School
SOC in a Box
Scotland's oldest and most presitgious private school announces the acquisition of KHIPU's Security Operations Centre (SOC) services to further enhance their cyber security capabilities. Solution: KHIPU Security Operations Centre (SOC)
Leicester College
SOC Services
KHIPU Networks Deliver Cost-Effective Education Sector-Specific Automated Endpoint Response Solution to Leicester College With an automated endpoint protection solution from KHIPU, Leicester College have now achieved an additional layer of proactive cyber security whilst freeing-up their more highly skilled technical resources to focus on high-level tasks Solution: KHIPU 'SOC Lite'
Canterbury Christ Church University
SOC Services
Canterbury Christ Church University implements KHIPU’s SOC to provide 24x7x365 visibility and protection against Cyber Threats Solution: KHIPU Security Operations Centre (SOC)
Bridgend College
Cloud Security
Immutable backup solution becomes a crucial asset in protecting Bridgend College against ransomware. Learn how KHIPU Networks and Rubrik helped Bridgend College recover quickly from ransomware attacks.
Colchester Institute
Cloud Security
Why having a ransomware Incident Response Plan and Solution is critical in today’s fight against cyber crime. Learn how Colchester Institute partnered with KHIPU and Implemented Rubrik for their outstanding protection and recovery from cyber breaches, coupled with ease of deployment and management.
University of Derby
SOC Services
Implementing a world-class SOC at the University of Derby The University of Derby has standardised on a proven Palo Alto Networks security solution, delivered as part of an eXtended Managed Detection and Response (XMDR) service powered by KHIPU Networks Security Operations Centre (SOC).
TEC Partnership
SOC Services
Proactively protecting one of England’s largest providers of further and higher education The TEC Partnership is reaping the rewards of the Palo Alto Networks portfolio, delivered as an eXtended Managed Detection and Response (XMDR) service powered by KHIPU Networks’ Security Operations Centre (SOC).
University of the Free State (UFS)
NGFW & Secure Remote Access
Securely expand remote access capacity with little time, no onsite access, and a limited budget University Rapidly Deploys Pandemic Remote Access Solution to Facilitate Teaching and Learning for 41,000 South African Students During Lockdown. Solution: Palo Alto Networks
Aldenham Foundation
Endpoint Security
Securing a Dynamic Learning Environment Learn how Aldenham Foundation secured their network and endpoints across multiple locations while pursing a cloud-first strategy. Solution: Palo Alto Networks
Colchester Institute
Cloud Security
How Colchester Institute Recovered from a Crippling Ransomware Attack within Days Learn how Colchester Institute recovered from a crippling ransomware attack within days through the deployment of Rubrik. Solution: Rubrik
University of the Free State (UFS)
Preventing Malicious Email Attacks with Proofpoint.
Explore how University of the Free State (UFS) uses Proofpoint Enterprise Protection blocks attacks, secures email and ends blocklisting. Solution: Proofpoint
North-West University
Achieving an 80% increase in security efficiency with Palo Alto Networks portfolio.
Palo Alto Networks portfolio provides this top-three South African university with trusted, innovative cybersecurity. Security efficiency has increased by 80%, and the university is on track to achieve a Zero Trust architecture. Solution: Palo Alto Networks
University of Cape Town
Prevention against phishing attacks
Learn how the University of Cape Town implemented KHIPU's simulated phishing and cyber security awareness solution to reduce its risks of cyber attacks. Solution: Simulated Phishing and Cyber Security Awareness (Phishing As A Service - PhaaS)
University of Winchester
Pro-active and automated vulnerability scanning and management
The only way to manage vulnerabilities across large 1000+ server environments is through automation. Find out how the University of Winchester uses vulnerability management to protect against and prevent cyber threats. Solution: Vulnerability Scanning and Management (Greenbone)
University of Southampton
Maintaining academic freedom while simultaneously reducing security risks
Having over 30,000 users on your network accessing the internet needs next-generation security to ensure the environment is protected against cyber attacks. Learn how the University of Southampton maintains it secure posture and enhances the user experience. Solution: Palo Alto Networks NextGen Firewalls
St John’s College
Creating student bubbles to enhance the University experience
Learn how St John's College, University of Cambridge, provides their students with a simple on-boarding process for all of their devices when arriving at the institution - with zero intervention from IT support / helpdesks. Solution: HPE Aruba Networks WiFi Clearpass Policy Manager (NAC)