The client
A&L Goodbody is one of Ireland’s leading law firms, advising clients across a wide range of legal and business matters. Operating in a highly regulated sector, the firm manages sensitive and confidential client information every day. As the organisation continued to make greater use of cloud services, it needed a security operations model that offered clear visibility, practical guidance and confidence in how risks were being managed.
The challenge
A&L Goodbody wanted to improve how security alerts were managed across its cloud environment.
The internal team needed clearer context around alerts, better prioritisation and a more practical way to separate routine activity from issues that needed attention. The goal was not simply to generate more security information but to make security operations more focused, useful and manageable.
The firm needed a managed security service that could support day-to-day operations while also helping improve its Microsoft security posture over time.
Key challenges:
Improving visibility across the cloud security environment.
Reducing unnecessary alert noise for the internal team.
Strengthening Microsoft security operations using Defender and Sentinel.
Providing clear, practical recommendations for ongoing improvement.
Giving the team more time to focus on risk reduction and control improvement.
The solution
CWSI worked alongside A&L Goodbody to implement a managed security service built on Microsoft Defender and Microsoft Sentinel, supported by the Chorus SOC.
The focus was deliberately practical. CWSI helped the firm move towards fewer, better alerts, clearer ownership and monthly recommendations that supported steady improvement across the environment.
By managing the security tooling day to day, CWSI gave the internal team more space to focus on the work that needed their judgement and expertise. CWSI stood beside the A&L Goodbody team with ongoing support, regular guidance and a clear view of what mattered most.
Solution components:
Managed security service built on Microsoft Defender and Microsoft Sentinel
SOC support through Chorus for monitoring, triage and response.
Day-to-day management of Microsoft security tooling
Clear alert prioritisation and escalation processes.
Monthly security recommendations to support continuous improvement
Ongoing collaboration with the internal IT and security teams.
The result
A&L Goodbody now has a more focused and manageable security operations model, with clearer visibility and stronger support for day-to-day security decisions.
Around 60% of alerts are now closed automatically by the SOC, allowing the internal team to focus on the issues that truly need their attention. This has helped reduce noise, improve response efficiency and support a more proactive approach to security.
Within the first year, A&L Goodbody’s Microsoft Secure Score increased from 60% to 70%, reflecting steady improvement in the firm’s underlying security posture.
The work also created a trusted model for further collaboration. Following the SOC engagement, A&L Goodbody asked CWSI to apply a similar approach to other areas, beginning with Intune device management.
Key outcomes:
1
More focused and manageable security operations.
2
Around 60% of alerts closed automatically by the SOC.
3
Improved Microsoft Secure Score, rising from 60% to 70% in the first year.
4
Clearer prioritisation of security activity across the environment.
5
More time for the internal team to focus on strengthening controls.
6
Expanded partnership into Intune device management
Why CWSI
CWSI helped A&L Goodbody move from managing security activity as a stream of alerts to working from clearer insight, stronger ownership and steady improvement.
By combining Microsoft security expertise, managed SOC support and practical monthly guidance, CWSI helped make security operations easier to understand, easier to act on and easier to improve over time.
