The agency operated Microsoft Sentinel for SIEM, AWS Security Hub for CIS benchmark compliance, Microsoft Entra ID for identity management, Azure Defender for cloud workload protection, Drata for SOC 2 controls, Palo Alto Networks for network security, HPE Aruba for zero-trust network access, Dynatrace for application performance, and LogicMonitor for infrastructure monitoring.
Each tool reported its own severity scale. None of them talked to each other. The security team spent the first 3 hours of every week manually aggregating data across dashboards just to answer the question their CISO asked every Monday morning: “Where are we on risk?”
Spent manually aggregating data from 9 tools every Monday
Mean time to detect correlated security events across multiple sources
Three weeks after go-live, Aegis detected an 8.5σ deviation in the agency’s AWS Security Hub CIS benchmark score — a drop from 84% to 69% over 72 hours. The drift was caused by 8 CIS controls failing simultaneously across IAM configuration and S3 encryption settings.
What made this remarkable: Aegis correlated the CIS failures with an unusual authentication pattern in Entra ID (847 failed login attempts over 4 hours) and a C2 traffic signature detected by Palo Alto Networks on port 8443. Three separate tools, three separate signals — connected automatically into a single Priority 1 Action Card at 02:15 UTC.
Without Aegis, these three signals would have been investigated separately by different team members. The correlation — which pointed to a coordinated credential-stuffing attempt — would likely have taken days to surface, if at all.
