The manufacturer already had endpoint protection. Then SilverSky’s analysts noticed suspicious network activity. The endpoint tools could not validate it. This is an awkward moment in cybersecurity: one instrument suggests trouble, another offers no confirmation, and production must keep moving. The question becomes whether the business is safe, or whether its instruments are looking in the wrong places.
- SilverSky combines managed controls, advisory work and 24-hour threat investigation.
- Its customers include regulated businesses with more security obligations than internal capacity.
- Its manufacturing case shows why visibility must be tested, even when protection is installed.
The sensor that changed the story
In SilverSky’s account of that engagement, the customer initially kept its existing endpoint platform while adopting Lightning MxDR, the company’s managed extended detection and response service. SilverSky enabled additional endpoint detection capabilities through its agent, which was already deployed. Almost immediately, analysts found evidence of malicious activity, including tools associated with credential theft and lateral movement.
They confirmed the compromise, notified the customer and coordinated remediation. The manufacturer subsequently expanded managed endpoint detection and response across its endpoints. Continued monitoring identified more malicious activity, which was isolated and removed. The decisive change was better evidence. The original protection tools had left analysts unable to explain what the network was telling them.
This is an anonymized case published by the vendor, so it deserves that qualification. But it gives SilverSky’s proposition a useful shape. The company sells people and operating processes alongside technology: someone to investigate a contradiction, establish whether it matters, and help the customer act. A quiet dashboard has limited value if the underlying coverage is incomplete.
- 01Network signalSuspicious activity raises a question.
- 02Endpoint contextAdditional telemetry reveals attacker tools.
- 03Human decisionAnalysts confirm, escalate and coordinate.
Sequence from SilverSky’s manufacturing case; no response-time metric disclosed.
A business bought, sold, and bought back
SilverSky’s operating history reaches back to 1997. By 2014, its cloud-based email protection, network security and managed applications had attracted BAE Systems. The defense group agreed to acquire the business for $232.5 million. At the time, BAE described approximately 5,500 customers and expected annual sales of about $75 million. Those figures belong to that transaction’s era.
In November 2020, a private investor group led by Richard Dobrow and Cary Conrad bought SilverSky from BAE. SQN Venture Partners led the financing. The announcement described more than 3,000 global customers and revenue above $50 million. Ownership had changed again; the need to help organizations handle security and compliance remained.
The next expansion combined money with acquisitions. An October 2021 agreement called for ITOCHU International to invest $31.5 million, supporting worldwide scale and access to Japan and Asia-Pacific. SilverSky also acquired Advanced Computer Solutions Group in 2021, followed by Cygilant and Cybraics in 2022. Cybraics brought behavioral analytics and threat-hunting technology developed from a Department of Defense learning research program.
BAE Systems buys the business
ITOCHU backs expansion
These deals describe an effort to assemble capabilities, customers and distribution. In April 2024, an inside funding round led by SQN backed further market expansion and platform development. Conrad became CEO in March 2026 after serving as president and helping develop Lightning. His appointment announcement emphasized a familiar customer demand: “They require clarity, accountability, and measurable risk reduction.”
Rent the operating capacity
The current offer has three connected parts. Advisory services assess risk, test defenses, interpret compliance requirements and provide security leadership. Managed Security operates controls such as email protection, firewalls and endpoint defenses. Lightning MxDR adds continuous monitoring, investigation and coordinated response. The distinction matters: administering a firewall and investigating an intruder require different work, even when the same customer needs both.
Customers can take different routes. Lightning Complete uses Cynet capabilities to broaden coverage across endpoints, mobile, email, cloud and SaaS. Microsoft-focused services support environments built around tools such as Sentinel and Defender. SilverSky’s stated approach begins with the customer’s existing environment, preserving useful investments while identifying changes needed to improve coverage.
The Lightning Portal gives customers visibility into security activity, investigation progress, escalations, reporting and audit-supporting history. That record matters because outsourcing the monitoring does not remove the customer’s need to understand the incident. A useful service must leave an internal team able to see what happened and explain the response to colleagues responsible for risk.
The business model is recurring managed service delivery, with advisory engagements alongside it. Partners include MSPs, resellers and technology advisors that want to offer security operations without staffing their own security operations center. For a lean customer team, the purchase is access to expertise and a continuous operating function. A meaningful cost comparison must include the internal work the service assumes.
For procurement, the comparison should begin with a written division of labor. Specify the covered devices and log sources, the actions the provider can take, and the decisions retained internally. Then compare quotes against that same boundary. Otherwise, two services described as MxDR may leave the customer with very different workloads.
That places SilverSky among managed detection and response providers such as Arctic Wolf and Sophos, which also offer continuous monitoring and investigation. Around-the-clock coverage alone cannot settle the comparison. SilverSky’s particular pitch joins regulated-market experience, managed controls and advisory work with flexible technology support. Buyers still need to examine the actual service scope, integrations and response responsibilities.
The work between the alerts
Another SilverSky case describes a nationwide mortgage lender mapping relevant attacker techniques to MITRE ATT&CK, then comparing them with existing defenses. Recommendations included better log collection, expanded telemetry and refined detection logic. Quarterly reviews kept the exercise current. The useful habit is repeatable: identify likely attacks, test coverage, prioritize gaps, then return to the map.
Readers can copy the method before signing a contract. Choose a relevant attack technique and trace its evidence through the environment. Check whether the necessary logs arrive, whether an analyst can interpret them, and whether an agreed response follows. Each handoff exposes a different kind of gap.
A healthcare case makes the operating problem harder. Vulnerable medical devices showed suspicious communications, but an immediate patch was unavailable and patient care depended on their continued operation. SilverSky describes working with the hospital on compensating controls, closer monitoring and a Zero Trust network strategy. Detection could inform the decision; clinical availability constrained the response.
A quiet dashboard has limited value if the underlying coverage is incomplete.
The operating lesson
In May 2026, SilverSky announced a Torq partnership after a proof of concept across AI SOC automation platforms. The intended gains were faster investigation and response orchestration with human oversight. The manufacturer’s experience supplies the buyer’s test: does the service obtain enough evidence, and can someone act on it? Without telemetry, agreed authority and customer follow-through, a monitoring contract leaves essential work unfinished.