{"id":33071,"date":"2026-07-13T17:01:20","date_gmt":"2026-07-13T15:01:20","guid":{"rendered":"https:\/\/sits.com\/?post_type=cases-cpt&p=33071"},"modified":"2026-07-13T17:02:12","modified_gmt":"2026-07-13T15:02:12","slug":"security-operations-center-for-sunweb","status":"publish","type":"cases-cpt","link":"https:\/\/sits.com\/en\/customer-stories\/security-operations-center-for-sunweb\/","title":{"rendered":"Security Operations Center for the digital travel industry at Sunweb"},"content":{"rendered":"

[vc_row custom_background_transition=\"gradient-up-transition\" full_width=\"stretch_row_content_no_spaces\" el_id=\"header\"][vc_column]

\n\n \n
\n
\n
\n \"\" <\/div>\n
<\/div>\n <\/div>\n\n
\n
\n \"\" <\/div>\n
\n Efficient Protection against Cyber Threats with SITS \n <\/div>\n

\n Security Operations Center for the digital travel industry at Sunweb \n <\/h1>\n \n
\n <\/div>\n <\/div>\n\n <\/div>\n \n \n \n \n \n\n<\/div>\n\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-central\"][vc_column]
<\/div>\n
\n
\n
\n

\n Initial Situation & Client Profile <\/h2>\n <\/div>\n
\n <\/div>\n
\n How can a Security Operations Center (SOC) be established and information security sustainably strengthened in an international tourism company?<\/p>\n

The Sunweb Group<\/strong> is one of the three largest tour operators<\/strong> in Western Europe, bringing around 1 million holidaymakers<\/strong> from the Benelux countries and Scandinavia to sunny destinations every year. Technologically, Sunweb operates like an e-commerce company focused on the online sale of package holidays. The company employs around 500 people and is active in seven countries.<\/p>\n

This success story shows how SITS supported the Sunweb Group in building a SOC, optimizing its Microsoft security landscape, and sustainably relieving the internal team<\/strong>.<\/p>\n

Client: <\/strong>Sunweb Group<\/p>\n

Industry: <\/strong>Tourism<\/p>\n

Our Services: <\/strong>Establishment & operation of a SOC, implementation of Microsoft Defender & Sentinel, phishing analytics, incident response, process definition <\/div>\n <\/div>\n

\n
\n \"Use <\/div>\n<\/div>\n<\/div>
<\/div>\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-up\"][vc_column]
\n
\n
\n The Project in Numbers <\/div>\n
\n A project with measurable progress: <\/div>\n <\/div>\n
\n\n
\n
\n
\n 1000000 <\/div>\n
\n + <\/div>\n <\/div>\n
\n Travellers supported per year <\/div>\n \n <\/div>\n
\n
\n
\n 7 <\/div>\n
\n <\/div>\n <\/div>\n
\n Countries in operative Focus <\/div>\n \n <\/div>\n
\n
\n
\n 500 <\/div>\n
\n <\/div>\n <\/div>\n
\n Employees <\/div>\n \n <\/div>\n
\n
\n
\n 1 <\/div>\n
\n <\/div>\n <\/div>\n
\n integrated Security Operations Center <\/div>\n \n <\/div>\n \n <\/div>\n\n\n<\/div>\n\n
<\/div>\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-down\"][vc_column]
<\/div>\n
\n
\n
\n

\n The Challenge <\/h2>\n <\/div>\n
\n Establishing a modern security structure. <\/div>\n
\n Before the collaboration, Sunweb had a small internal security unit and was not yet optimally using existing Microsoft E5 licenses.<\/p>\n

Structured risk management and its own SOC had not yet been established, so operational tasks such as phishing and alert handling placed a heavy burden on the team.<\/p>\n

A partner was sought who not only provides technical solutions but also assumes operational responsibility, establishes processes, and relieves the internal team<\/strong>. <\/div>\n <\/div>\n

\n
\n \"\" <\/div>\n<\/div>\n<\/div>
<\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]
\n
\n
\n

Approach & Strategy<\/h2>\n
<\/div>\n <\/div>\n
\n
\n
\n
\n
<\/div>\n\n
 <\/div>\n \n \n <\/div>\n
\n
<\/div>\n\n
 <\/div>\n \n \n <\/div>\n
\n
<\/div>\n\n
 <\/div>\n \n \n <\/div>\n
\n
<\/div>\n\n
 <\/div>\n \n \n <\/div>\n
\n
1<\/div>\n <\/div>\n
\n
2<\/div>\n <\/div>\n
\n
3<\/div>\n <\/div>\n
\n
4<\/div>\n <\/div>\n
\n
<\/div>\n
<\/div>\n <\/div>\n <\/div>\n <\/div>\n
\n
<\/div>\n
<\/div>\n <\/div>\n <\/div>\n
\n
\n
 <\/div>\n
Establishing a security foundation<\/div>\n
Rapid technical activation of Microsoft Defender and Sentinel as SOC services.<\/div>\n <\/div>\n
\n
 <\/div>\n
Structuring collaboration<\/div>\n
Structured onboarding and targeted knowledge transfer: Joint development of playbooks, clear role allocation, and transparent responsibilities.<\/div>\n <\/div>\n
\n
 <\/div>\n
Optimizing security operations<\/div>\n
The Microsoft security solutions were adapted to Sunweb\u2019s requirements and efficient workflows for collaboration were established.<\/div>\n <\/div>\n
\n
 <\/div>\n
Realizing the potential of E5<\/div>\n
The existing E5 licenses are optimally used so that the Sunweb team can focus more on strategic security tasks.<\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n
<\/div>\n
\n
\n
\n

\n Implementation <\/h2>\n <\/div>\n
\n From concept to operational security: Efficiently realized for sustainable protection. <\/div>\n
\n The technical activation of the Microsoft solutions was completed in a short time \u2013 the real task lay in onboarding, process definition, and knowledge transfer.<\/p>\n

SITS assumed operational responsibility for security monitoring, jointly defined playbooks with Sunweb, and established efficient workflows<\/strong> for alert handling and incident response<\/strong>.<\/p>\n

The collaboration was characterized by openness, transparency<\/strong>\u00a0and the<\/strong> goal of sustainably increasing Sunweb\u2019s security maturity<\/strong>. <\/div>\n <\/div>\n

\n
\n \"\" <\/div>\n<\/div>\n<\/div>[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-up\"][vc_column]
<\/div>\n
<\/div>\n
\n
\n\n
SITS focuses on the security operational aspects handling incident triage and phishing email reports, enabling us, the internal security team at Sunweb, to focus on strategic initiatives, like rolling out new capabilities, conducting assessments and actually fixing things.<\/p>\n

\u2013 Cristian Pascariu, Head of Information Security, Sunweb<\/div> \n \n <\/div>\n<\/div>

<\/div>\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-down\"][vc_column]
\n
\n
\n

\n The Result <\/h2>\n <\/div>\n
\n Relief, focus and measurable improvement of security. <\/div>\n
\n By taking over operational security operations, SITS enabled the internal team to focus on strategic tasks such as assessments, rollouts, and improvements.<\/p>\n

Security maturity increased from \u201cmedium-high\u201d to \u201chigh\u201d, the configuration of the Microsoft E5 solutions was optimized, and the number of false positives was significantly reduced.<\/p>\n

Through collaboration with SITS, Sunweb was able to sustainably strengthen information security<\/strong> and relieve the internal team<\/strong>.<\/p>\n

Today, they benefit from optimized processes and more freedom for strategic tasks. <\/div>\n <\/div>\n

\n
\n \"\" <\/div>\n<\/div>\n<\/div>
<\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]
\n
\n
<\/div>\n \"\"\n <\/div>\n
\n
Secure your Digital Infrastructure too<\/div>\n
<\/p>\n

Would you like to professionalize your security operations or optimally use your Microsoft security landscape?<\/p>\n

Our experts will be happy to advise you \u2013 individually, competently, and practically.<\/p>\n

<\/div>\n

<\/div>\n\n
\n
\n \n Get free advice <\/a>\n
<\/div>\n <\/div> \n <\/div>\n <\/div>\n<\/div>
<\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]\n
\n
\n
\n How we protect companies <\/div>\n
\n Every success begins with trust. Discover how we make digital security a reality in real projects. <\/div>\n
\n <\/div>\n<\/div>\n\n
\n
\n
\n \n <\/div>\n
\n \n <\/div>\n <\/div>\n<\/div>\n\n
\n\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n How dena future-proofed its IT infrastructure <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n Identity & Access Management in the Municipality of Rotterdam <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n NIS-2 Implementation in the County of Goslar <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n Security Operations Center for the digital travel industry at Sunweb <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n Cyber Defence for the international infrastructure industry at Ramudden <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"Use <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n Platform Development and Identity Management at ITSG <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n LeasePlan counts on modern IAM Solutions <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n Data protection management rebuilt at finstreet <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n TISAX recertification in record time <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n Efficient access control: Utrecht relies on SITS|Traxion <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n \n
\n \"\" <\/div>\n
\n <\/div>\n \n
\n
\n
\n
\n
\n <\/div>\n <\/div>\n
\n Global Identity Governance at Randstad <\/div>\n
\n Mehr erfahren <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/a>\n <\/div>\n
\n
\n <\/span>\n <\/div>\n<\/div>\n<\/div>[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-central\" el_id=\"contact\"][vc_column]
<\/div>\n\n
\n
\n
\n Get in touch now <\/div>\n
\n Find out how we can protect your company too <\/div>\n
\n