Cipher makes the security tools talk.

A security alert is a small demand for attention. Multiply it by a few thousand, scatter the evidence across different systems, and the demand becomes a queue. Someone still has to decide what matters. Cipher has built its proposition around that awkward interval between a machine noticing something and a person knowing what to do.

The company calls its platform xMDR, short for Extended Managed Detection and Response. Beneath the abbreviation sits a practical sales argument: keep the defenses you own, bring their evidence together, and give the people investigating it better context. For a buyer surrounded by expensive software, that is an appealing place to start.

Too many alarms. Too little agreement.

Cipher was founded in 2000 by Eduardo Bouças. In December 2018, Prosegur announced an agreement to acquire a majority stake; Bouças’s later biography dates the sale to 2019. The security group wanted complementary geography and expertise, including Cipher’s operations in the United States, Brazil and Britain. It also wanted to connect physical and digital risk.

That ownership helps explain Cipher’s breadth. Alongside detection and response, it sells security integration, penetration testing, governance and compliance work. Its Protect service reaches into operational technology, connected medical devices and smart buildings. These are environments where a security decision can affect a business process or a physical operation.

Prosegur’s account of xMDR’s development identifies the pressure behind the product: fragmented technology, incomplete visibility and scarce specialists. Carlos A. Fernández, an xMDR executive, described a “tsunami of alerts.” The problem was already familiar to the business. Adding products had made the evidence harder to assemble.

The scarce resource is the attention needed to turn an alert into a decision.An operational lesson from Cipher’s approach

Follow the behavior, then join the evidence.

Cipher’s method starts with the adversary. Its Unit X63 research function studies attackers, their campaigns and their tactics. The platform uses a customer’s profile to help determine relevant detection rules. Those rules sit above existing technologies, while alert processing correlates and groups the resulting signals. The aim is an investigation with context, rather than another isolated warning.

There is software here, and there is a service. Customers can contract the platform or add managed operations. The service includes ongoing threat hunting, investigation and response, with a centralized portal and a named customer adviser. Cipher positions itself between the customer’s technology estate and the operational work required to defend it.

That makes integration its central competitive argument. An alternative is to staff an internal security operations center or buy another provider’s managed service. Cipher asks buyers to consider how much of their current stack can be retained. Its vendor-neutral positioning deserves a demonstration using the buyer’s actual systems.

The parent company becomes the test.

One useful customer example is Prosegur itself. Cipher’s published case describes a sprawling environment serving different employee roles around the world. The work imported 350 existing detection use cases and produced 1,000 improved or adapted rules in five days. It also used Proofpoint API integration routines and security awareness measures.

The case reports roughly 35% fewer analyses required from analysts while maintaining treatment of all alerts. That is a more useful claim than a raw count of signals collected: it concerns human workload. Still, it belongs to a company-published account of one deployment. A prospective customer should ask what counted as an analysis and what changed in the underlying environment.

The customer mix extends beyond the parent. CE Consulting’s Spanish deployment combines endpoint detection, cloud audits, a security operations center and training. Healthcare provider Affidea is another named customer. These examples point toward organizations with several security obligations at once: keeping systems available, protecting sensitive information and demonstrating that controls work. Cipher can supply both operational coverage and specialist project work.

The revealing detail is a Jira ticket.

In October 2026, Cipher and Brazilian payments infrastructure company Fitbank described a different assignment. Fitbank needed PCI DSS and PCI PIN security compliance in a cloud-native environment. The companies reported completing both certifications in 11 months without interrupting operations. The technical work included adapting requirements associated with traditional data centers to cloud architecture.

The memorable detail is an integration between Jira and hardware security modules, or HSMs. Requests, approvals and management of cryptographic keys became part of an automated workflow. Security moved into the machinery of everyday work. The reusable idea is precise: connect a sensitive action to its approval process and make the resulting trail auditable.

That assignment also shows why Cipher keeps advisory work beside monitoring. Its governance, risk and compliance practice offers gap analysis, risk analysis and maturity assessments. Its audit services cover standards including ISO 27001 and PCI DSS. Its red teams test internal and external systems and run social engineering exercises. The customer can examine a weakness, test its defenses and decide what needs changing.

Yesterday’s logs get another hearing.

Also announced in October 2026, Retrospective Threat Hunting adds a backward-looking function to SOC by xMDR. When new threat intelligence arrives, it checks historical customer data for relevant traces. A match opens an investigation for Cipher specialists. Evidence that seemed unremarkable when collected can acquire meaning later.

The commercial routes are widening too. Cipher announced its Microsoft Azure marketplace integration in February 2025 and a Securonix partnership that September. The latter combines managed security operations with SIEM technology for channel partners. An April 2025 ECIJA alliance brings legal expertise into governance, risk and compliance engagements.

These partnerships address different buying needs. A legal team needs regulatory interpretation. A technology partner needs an operation it can deliver to customers. A security manager needs coverage that fits existing infrastructure. Cipher’s mix of services gives it several ways into those conversations, with integration as the common thread.

Buy the investigation. Check the plumbing.

Cipher’s public materials invite sales discussions rather than publish a standard price. Evaluation therefore needs a defined scope: technologies covered, data retained, response responsibilities and the people available when something happens. The Fitbank account gives an implementation duration, but its announcement supplies no project fee.

The approach depends on usable evidence and functioning integrations. Retrospective hunting needs retained history; managed response needs agreed authority to act. A company unable to provide those foundations will get less value from the model. The lesson readers can copy is to test the whole path: signal, investigation, decision, action. Ask the provider to show where each handoff happens.