With Scanner, investigations now take minutes instead of potentially days. We can build detections and very complex queries across huge subsets of data that would literally take hours with legacy platforms that take seconds to minutes with Scanner.
Case STUDY
KAST cuts investigation time from days to minutes while retaining full data ownership with Scanner
About
KAST is a money app that connects digital assets with traditional finance, enabling 1 million+ people to send, receive and convert funds across borders, currencies and payment rails through a single app.
Industry
Financial Services
COMPANY SIZE
201 - 500
Founded
2024
Highlights
- The company has a rapidly scaling global team, with millions of events flowing through its customer platform and internal stack daily.
- Before Scanner, KAST’s security team pieced together visibility across many disconnected systems, each with its own logging format and alerting standard.
- KAST keeps full ownership of its data. Scanner runs directly on top of KAST’s own tenancy and infrastructure, and the team decides what gets ingested and how.
- Investigations that once spanned 15 or more systems now run as a single query, completing in seconds to minutes instead of hours or days.
- Detection engineers write and push detection rules as code, source controlled, in minutes instead of days.
Executive Summary
Challenges
KAST's security operations team works 24/7, triaging hundreds of events a day across a platform generating millions of events daily. Before Scanner, that meant working across many disparate systems, each with a different logging format, alerting protocol, and standard, which slowed operations. Correlating signals and building detections across so many disconnected tools would have forced KAST to scale its security headcount well past what a company its size could sustain. As a financial platform built on stablecoins, trust sits at the center of KAST's business. Fragmented tooling made it slower to correlate signals and maintain consistent visibility as KAST scaled. Handing data to a vendor to triage on KAST's behalf wasn't compatible with the team's requirement to retain and own its data directly.
Solution
KAST deployed Scanner on top of its own data, retained entirely within its own tenancy and infrastructure. The team controls exactly what gets ingested and how, rather than sending data into a third party's systems. Setup took a couple of days, not the multi-phase demo and proof-of-concept process common with larger enterprise security vendors. Scanner replaced KAST's patchwork of logging formats and alerting standards with one system and one query syntax that every engineer on the team knows well. Detection engineers now write detections as code and push them in minutes, fully source controlled. Complex queries across large volumes of data that once took hours, and investigations that spanned 15 or more separate systems, now run as a single query in seconds to minutes. That speed has let a small security team keep pace with a company scaling from 5 employees to 360 in two years, without needing to grow headcount at the same rate.
Key benefits
Moving to Scanner changed both the scope and speed of KAST’s security operations:
- Faster investigations: complex queries that once took hours, or investigations spanning 15+ systems, now complete in seconds to minutes.
- Full data ownership: KAST retains all security data within its own tenancy and infrastructure, choosing exactly what gets ingested and how.
- Rapid deployment: KAST stood up Scanner in a couple of days, without the multi-phase demo and POC cycle typical of enterprise tools.
- One standardized platform: a single query syntax replaced many disparate systems with different logging formats and alerting protocols.
- Detection-as-code: detection engineers write and push source-controlled rules in minutes instead of days
Something that's very important to us is retaining and owning our own data. There are a lot of vendors out there that want you to send your data blindly into their systems and let them triage it for you. With Scanner, we own our data. We retain all of it in our own tenancy, within our own infrastructure, and deploy Scanner directly on top of our own data set.