How ECI Uses Elastic to Protect 130 Financial Services Clients Against Cyber Threats

ECI serves financial services organizations across the globe as a managed services provider, handling IT infrastructure, cybersecurity, and business transformation for clients who collectively oversee more than $3 trillion in assets under management. For these clients—hedge funds, asset managers, and financial firms—security isn’t a compliance checkbox; it’s a business-critical requirement where a breach or audit failure has direct financial and reputational consequences.

Before building its unified SIEM offering, ECI’s internal security had fragmented across teams. Each department managed its own event logs in different formats for different clients, creating data silos that made threat detection slow and log retention for regulatory compliance difficult to guarantee. Kamyar Kojouri, Director of Security Operations, identified the core problem: event logging was becoming unmanageable as the client base grew, and the patchwork approach couldn’t scale.

ECI’s engineering team evaluated Elasticsearch and assembled a proof of concept in just a few days—a complete cluster with agent deployment, log ingestion, and dashboards. An Elastic engineer worked on-site with the team for a week to configure the production system. Elastic Cloud Enterprise became the deployment backbone, enabling ECI to add new clients quickly with consistent configuration. Kibana provides a “single pane of glass” for security alerts, incident investigation, and threat hunting. Elastic Security transforms event feeds into actionable threat intelligence, and cross-cluster search lets ECI’s Security Operations Center run threat hunting queries across all client clusters from a single node—a critical capability for responding to widely reported security incidents across many clients simultaneously.

The results validated the architecture. ECI onboarded 130 clients in 18 months. The platform now ingests more than 2 billion events per day across client environments spanning ECI Cloud, Microsoft Azure, and on-premises systems. New clients are operational in two weeks or less. When major hacking incidents make the news, ECI can immediately search all client SIEM data to confirm whether any client is affected and respond proactively.

Looking ahead, ECI is evaluating real-time threat response automation using machine learning, XDR (eXtended Detection and Response) capabilities for unified endpoint and SIEM security, and a single data ingestion pipeline to further consolidate client environments. The Elastic platform’s scalability has made cybersecurity one of ECI’s fastest-growing service lines.