Iress provides financial technology that supports market trade orders and sensitive financial data for thousands of individuals worldwide. With SentinelOne, the company unified protection across endpoint and cloud environments, reduced incident response from hours to minutes, cut threat-hunting time by 80–90%, and automated more than half of routine alert handling.
Safeguarding a Global Trading Platform
Across the globe, trading and market-data professionals rely on Iress software to access markets, analyze data, and execute trades quickly and accurately. Headquartered in Melbourne, Australia, Iress connects to over 160 exchanges and 500 trading partners worldwide, facilitating more than 80% of UK retail market flow.
In financial markets driven by sub-millisecond execution, securing latency-sensitive systems and safeguarding sensitive financial data is vital to operational continuity. Standardizing on the SentinelOne Singularity platform, Iress’s lean security team has consolidated disparate tooling, automated cloud remediation, and cut threat-hunting timelines by 80-90%.
“Iress looks after the financial data of thousands of people around the world, and it's critically important that we're able to secure that information properly,” explained John Paul Lonie, Head of Security Operations at Iress.
Consolidation Across a High-Velocity Financial Network
Securing global trading architecture requires balancing strict data privacy with uncompromising system performance. Iress safeguards financial and personal data for thousands of individuals while supporting ultra-low-latency execution environments across trading systems, specialized databases, and web servers. Iress’s security team set out to consolidate its large collection of tools and standardize protection across its diverse technology estate.
“We're a very small team at Iress, so it's important for us to be innovative about how we approach cybersecurity: our tools, our partnerships, and the way we conduct ourselves,” Lonie said.
To streamline governance, Iress selected SentinelOne to consolidate multiple security utilities into a unified, simple-to-use platform.
“SentinelOne could support our wide variety of environments, so it became an easy choice,” Lonie said. “We reduce our disparate tooling into a single, simple-to-use platform, making it easy for our teams to come up to speed.”
Leveraging Singularity Network Discovery, Iress rapidly identified unmanaged endpoints and deployed protection across its distributed infrastructure. Wayfinder Elite helped tune custom exclusions for specialized trading platforms, ensuring complete protection without degrading speed.
Accelerating Investigation and Threat Hunting with Purple AI
Ingesting approximately 2 TB of telemetry daily, the team needed an efficient way to extract actionable context from massive data flows without creating analyst fatigue. By deploying Purple AI, Iress transformed its investigative capabilities. Analysts now utilize natural-language queries to hunt for latent threats, inspect configuration anomalies, and analyze execution trees.
Agentic Investigation extends the team’s capabilities, autonomously investigating suspicious activity and accelerating the path from detection to contextual understanding and response.
“Navigating our large volume of data is difficult for our small team, so we use Purple AI to find issues within our infrastructure,” said Shannon Cooper, Senior Security Information Analyst at Iress.
This automated support scales capacity across the SecOps team. When a primary analyst is unavailable, team members from adjacent disciplines can step in and execute investigations or threat hunts without specialized training.
Automating Cloud Security Workflows
As Iress migrates core infrastructure to multi-cloud environments, Singularity Cloud Native Security (CNS) delivers seamless coverage across cloud workloads without requiring a separate operational model. CNS continuously scans for misconfigurations and security drift, mapping against rigorous compliance standards including ISO 27001 and SOC 2.
To eliminate the manual coordination traditionally required to pass cloud findings to software engineers, Iress orchestrates remediation through Singularity Hyperautomation, which formats CNS alerts and automatically delivers actionable tickets directly to the correct teams.
“We have a lot of development teams and a lot of tools for managing their various workflows and tickets,” Cooper said. “Having a tool that can move those alerts from CNS and fan them out to the various product teams is really quite powerful for us.”
Iress also uses Hyperautomation to reduce alert noise and close more than 50% of alerts without requiring analyst intervention, allowing internal analysts and Wayfinder Elite to focus on higher-value investigations. Cooper estimates those workflows save weeks of manual effort each year while improving consistency in how issues are handled.
24/7 Managed Defense and Rapid DFIR Response
Iress has seen the value of its SentinelOne partnership during real cybersecurity incidents.
“Two years ago, Iress experienced a fairly major threat. SentinelOne stepped in with tools and people to help us navigate that situation,” Cooper said.
To ensure around-the-clock protection across time zones, Iress relies on Wayfinder Elite for continuous 24x7 monitoring and response. With Wayfinder Elite, triage and containment times dropped from hours down to minutes.
During a third-party penetration test, Wayfinder Elite demonstrated its speed by independently detecting the simulated attack and initiating automated endpoint containment within minutes, just as the external testing team was manually compiling their findings.
SentinelOne’s agility was tested during a regional incident in South Africa, where Iress required immediate forensic support. SentinelOne onboarded its Digital Forensics and Incident Response (DFIR) service in hours rather than days, deploying specialized responders to help contain the event. Supported by a dedicated Technical Account Manager (TAM), Iress maintains direct access to platform specialists to continuously optimize its security posture.
Scaling Security Operations with AI and Automation
With SentinelOne, Iress has built a unified security model across its endpoint and cloud environments worldwide while reducing operational overhead. AI, automation, 24x7 managed detection and response, and on-demand incident expertise enable the company to safeguard systems supporting billions of trade orders and sensitive financial data.
“With the ever-expanding nature of cyber threats, the number of alerts is only going up,” Lonie said. “Between Wayfinder Elite, Purple AI, and agentic investigations, our team is able to do much, much more than they've ever been able to before.”
