Strengthening Cyber Resilience for a Malaysia-Based Cooperative with Managed Detection and Response

Executive Summary

A Malaysia-based cooperative, operating as a public-listed entity with approximately 60 users, plays a critical role in supporting its members while upholding a strong level of trust and accountability. Despite its modest size, its responsibilities require consistency and reliability in day-to-day operations. Like many teams with limited IT resources, it faced the challenge of balancing operational efficiency with the need for stronger cybersecurity measures as threats continue to evolve in both scale and complexity.

The Challenge

The organisation experienced a ransomware attack that exposed significant gaps in its cybersecurity posture, highlighting several critical issues:

No 24×7 Monitoring

Threats occurring outside business hours went undetected, allowing ransomware to dwell and spread without timely intervention.

Slow Response and Lack of Preparedness

The organization relied on ad-hoc IT support with no defined incident response (IR) runbook, no on-call Security Operations Center (SOC), and no forensic readiness.

Expanded Attack Surface

Remote endpoints, cloud workloads, and unmanaged assets stretched traditional perimeter defenses beyond their limits.

Advanced Threat Tactics

Modern ransomware leveraged living-off-the-land techniques and EDR-evasion strategies that signature-based tools failed to detect.

Regulatory and Trust Risks

With obligations under the Personal Data Protection Act (PDPA), the koperasi faced compliance challenges, including breach reporting and evidence preservation gaps.

Resource Constraints

A lean IT team lacked the capacity to staff a 24×7 SOC, conduct proactive threat hunting, or perform forensic investigations in-house.

These challenges underscored the urgent need for a comprehensive, cost-effective solution that could deliver continuous monitoring, rapid response, and compliance support.

The Solution

The approach taken was not to introduce more standalone tools, but to establish a clearer and more continuous view of what was happening across the environment, supported by the ability to act on it in real time.

FatNinjas implemented a Managed Detection and Response (MDR) service tailored to the organisation’s needs. The solution provided end-to-end security operations, including monitoring, triage, containment, and remediation, all managed by experienced security analysts. Key components included:

  • Integrated Security Stack:  Endpoint Detection and Response (EDR), Network Detection and Response (NDR), and identity telemetry fused into a single platform enriched with built-in threat intelligence.
  • Advanced Detection Capabilities:  Behavioral analytics, machine learning-driven anomaly detection, and curated threat intelligence to identify threats that traditional signature-based tools miss.
  • Co-Managed Approach:  SRKK acted as a trusted local advisor, handling onboarding, tuning, escalations, and conducting quarterly business reviews in collaboration with the principal provider.

This approach ensured that the organisation could maintain strong security without the overhead of building an in-house SOC.

The Result

The MDR implementation delivered measurable improvements across several key areas, strengthening both the organisation’s security posture and operational readiness.

Mean-time-to-detect (MTTD) was reduced from days to minutes through continuous 24×7 monitoring, allowing threats to be identified much earlier. This enabled active containment measures that stopped ransomware before encryption could spread across systems. At the same time, post-incident hardening efforts addressed the specific vulnerabilities exploited during the March 23 attack vector, reducing the likelihood of similar exposure going forward.

There was also a clear shift in how security was managed from a cost perspective. By moving to a managed service model, the organisation avoided the significant investment required to build and sustain a fully staffed 24×7 security operations team internally. The subscription-based approach introduced greater cost predictability, removing the need for large capital expenditures following the incident. In addition, the inclusion of a complimentary firewall bundle strengthened perimeter defences without introducing additional cost.

Improvements were also seen in compliance readiness. Audit-grade logging and reporting now support PDPA requirements, ensuring that security events can be properly documented and reviewed. A clearly defined incident response process has also been established to ensure better preparedness for breach handling. Alongside this, quarterly executive reviews now provide leadership with consistent visibility into the organisation’s security posture, making it easier to track progress and address gaps over time.

With these foundations in place, the organisation has begun to address areas that were previously difficult to prioritise. Legacy systems are being phased out in favour of more modern, secure environments, while additional measures like email security and cloud-based platforms are being considered to further strengthen overall protection.

Through its partnership with FatNinjas, the organization has moved towards a more measured and proactive approach to cybersecurity, where risks are understood earlier, addressed more effectively, and managed as part of everyday operations rather than as isolated events.

Read other case studies >>

Loading...