How THG Cut Security Response Time 60% with Elastic ML Detection

THG’s rapid growth through acquisition created a security challenge that traditional multi-vendor approaches couldn’t handle. As the company expanded its technology stack to include a growing number of SaaS platforms and a zero-trust architecture, each new system came with its own logging format, interface, and query language. Security analysts were context-switching constantly, spending up to 90% of their time on first-line triage—a pattern that suppressed the proactive threat hunting and detection engineering the business needed.

The core problem was fragmentation: THG was ingesting logs from approximately 100 different data sources at up to 25,000 events per second, but no single platform could correlate, query, and act on that data efficiently. Storage costs for the volume of security data were also significant, requiring expensive hardware to maintain hot and warm tiers for data that was increasingly rarely accessed but still needed to be retained for compliance.

THG deployed Elastic Security as a replacement for its fragmented multi-vendor stack, consolidating all security operations into a single interface. The platform ingests from all 100+ data feeds, giving analysts a unified schema to query across the entire organization—device telemetry, phishing data, threat intelligence, and SOAR alerts—in a single language. Machine learning runs continuously to detect anomalies, including fraud patterns, data breach indicators, and denial-of-service signatures that fall below the threshold of rule-based detection. Elastic’s integration with THG’s SOAR platform enabled automated playbook execution, so when a threat pattern is identified, remediation steps begin automatically rather than waiting for analyst intervention.

The shift in operational profile was substantial. Mean time to respond fell by 60%. Analyst time spent on first-line triage dropped from 90% to 50%, freeing the security team to focus on threat hunting, detection engineering, and forward-looking security initiatives. Storage costs for infrequently accessed data—now held in Elastic’s cold and frozen tiers via searchable snapshots—fell by 60%, significantly reducing hardware dependency without sacrificing accessibility.

For THG’s Chief Security Officer, the value extends beyond incident response metrics. Elastic dashboards are now visible across different parts of the business, embedding security awareness in operational teams. The platform’s flexibility means that as THG acquires new businesses running on different technology stacks, those entities can be integrated into the same security architecture without re-engineering the detection layer. In an ecommerce environment where customer trust and transaction integrity are foundational, THG’s investment in unified, ML-driven security represents a direct business enabler.