Global Leader in Cybersecurity Software
Managed Detection & Response Platform
Build a robust MDR platform delivering SOC services: 24/7 monitoring, threat hunting, incident management, reporting, and compliance enablement
We rebuilt the MDR backend on a modern, cloud-native stack - enabling 24/7 threat monitoring, fast investigations and automated incident response across hybrid environments.
The client needed a scalable MDR backbone to unify telemetry, accelerate investigations, and standardize incident response across heterogeneous customer environments.
Key requirements included 24/7 monitoring, advanced threat hunting, prioritized investigations with expert recommendations, and strict compliance.
All the deliveries needed to have high reliability and smooth integration into existing tooling and workflows.
Key results
- Always-on coverage with centralized telemetry and real-time alerting.
- Measurably lower MTTD/MTTR through automated triage and guided remediation.
- Seamless identity and access control via Amazon Cognito (zero-trust aligned).
- Reliable, repeatable releases with CI/CD and end-to-end test automation.
- Compliance-ready audit trails and policy-driven, pre-approved actions (PAAs).
Qualysoft solution
- Cloud-Native Backend (Quarkus on AWS) — High-performance microservices running on AWS with Lambda for elastic compute and event-driven processing.
- Identity & Security — Amazon Cognito for authentication/authorization and fine-grained, least-privilege access; encrypted data paths and auditable actions.
- Operations & Delivery — CI/CD pipelines, immutable builds, canary deployments; TestCafe automated UI/regression suites for stable, frequent releases.
- Integrated Communications — Amazon SES for secure, policy-controlled notifications and reports.
- AI-Assisted Workflows — Amazon Q integrated to assist analysts with context retrieval, playbook guidance, and investigation summaries (human-in-the-loop).
- Pre-Approved Actions (PAAs) — Policy-driven response actions with role-based approvals, ensuring compliant and rapid containment.
Top platform components
- MDR Portal & Reporting
- 24×7 Security Coverage & Telemetry Ingestion
- Threat Hunting Workspace
- Incident Root-Cause & Impact Analysis
- Expert Recommendations & Playbooks
- Pre-Approved Actions (PAAs)
Business Outcomes
- Faster detection and response with automated triage, analyst assist, and standardized playbooks—lowering operational risk.
- Operational reliability at scale via serverless elasticity, observability, and automated testing.
- Seamless customer experience with unified portal, consistent reporting, and policy-driven notifications.
- Compliance & audit readiness through traceable actions, approval workflows, and immutable logs.
- Future-ready architecture that supports new data sources, response actions, and tenants without disrupting service.
More success stories
Re-architected GPS fleet tracking for scale
Domain-driven re-architecture of a fleet-tracking platform. 70× performance, 40% less complexity, 2,400+ automated tests.
Core Tax Administration System for 270M+ taxpayers
Fully integrated digital tax administration system serving 270M+ taxpayers. Registration, filing, payments, audit, enforcement.
Ready to modernise your security platform?
Bring us the architecture — we'll tell you what we'd build, ship, and operate on AWS or Azure.