CASE STUDY
From 3-Day Breach Discovery to 10-Minute Detection on a 24/7 Betting Platform
Background
Our customer is a licensed iGaming operator running a production casino environment that accepts bets 24 hours a day, every day of the year. When the partnership with UnderDefense began in 2019, security monitoring covered only the production environment, and only during business hours of 8 hours a day, 5 days a week. The corporate segment sat outside SOC coverage entirely, with one internal engineer responsible for it alongside other duties.
For a regulated operator processing live wagers around the clock, this model left two structural gaps in coverage. Every night, the SOC was offline, and every weekend it was offline for two full days. The corporate segment had no continuous monitoring at any time, regardless of the SOC schedule.
In December 2020, the consequences of those gaps became concrete. Over the holiday period, the corporate segment was compromised. With monitoring inactive on that segment and staffing reduced for the break, the intrusion remained undetected for three days before anyone noticed the signal. By that point, an attacker had been operating inside the corporate network for the entire weekend without a single alert reaching a human analyst.
The Challenge
The iGaming company needed to close three operational problems at once, and it needed to do so without adding internal headcount.
First, the SOC had to move from 8×5 to 24×7 coverage so that production alerts on a live betting platform were triaged every hour of every day, including holidays.
Second, the corporate segment had to be pulled under the same monitoring umbrella as production, eliminating the single-engineer dependency that had failed in December 2020.
Third, as the company invested in new detection tooling over the following years, every new platform had to be onboarded into the SOC quickly and feed into one operational view, instead of fragmenting analyst attention across five separate consoles.
A licensed iGaming operator carries regulatory exposure on top of standard business risk. A multi-day undetected intrusion on production would translate directly into license, payout, and reputational consequences. The detection window had to drop from days to minutes, and it had to stay there during weekends and public holidays when attacker activity typically peaks.
About the client
iGaming
Key Results
The Solution
After the December 2020 incident, the iGaming company shifted to 24×7 SOC coverage with UnderDefense and consolidated the corporate segment under the same monitoring umbrella as production. Both changes happened inside a single contract update, with no new internal headcount required on the customer side.
Over the following years, as the customer expanded its detection stack, UnderDefense onboarded each new platform into the SOC within weeks of acquisition. From 2024 onward, all connectors were unified inside the MAXI platform. MAXI became the single operational view across the full estate, showing alerts, incidents, ownership status, and SLA adherence in one place for both the customer’s team and UnderDefense analysts.
Recent production incident timeline
- 03:01 – Attack activity begins in the production casino environment
- 03:11 – First alert raised in MAXI (10 minutes from first attacker move)
- 03:36 – Initial triage complete (25 minutes from first alert)
| P1 · Critical | ≤ 15 min |
| P2 · High | ≤ 30 min |
| P3 · Medium | ≤ 2 hrs |
| P4 · Low | ≤ 4 hrs |
Outcomes
- Coverage without hiring.
Adding 24×7 monitoring on the corporate segment, on top of production, required zero new internal headcount at the iGaming company. The operating model absorbed the additional scope through the existing UnderDefense engagement. - One queue across all sources.
The detection signal from five security platforms feeds into MAXI as a single stream. The customer’s team works against one ownership model, one set of SLAs, and one weekly review cycle, regardless of which underlying tool generated the alert. - Predictable response times.
Every incident has a defined triage window tied to its severity. Monthly reporting shows SLA adherence alongside alert volume filtered and incidents handled, giving leadership a measurable view of SOC performance. - Holiday and weekend coverage, solved.
The 2020 gap that allowed a 3-day undetected intrusion no longer exists in the operating model. Production casino and corporate IT are both covered every hour of every day of the year.