Success Story: Herba Chemosan - Cyber Defense with Full Transparency
"For us, it was essential not to simply replace our SOC service, but to have the opportunity to jointly advance the maturity of our Security Operations.
With Bacher Systems and Swiss Post Cybersecurity, we now have partners who support us around the clock while giving us the transparency and level of control we need.
It is particularly important to us that we can continue using our existing Sentinel environment while remaining flexible enough to address future developments and challenges."
The Challenge: More Than Security Monitoring
Herba Chemosan was already using an external SOC service based on Microsoft Sentinel. As IT security requirements increased, however, it became clear that the SOC model also needed to evolve to meet future demands.
The company was therefore not simply looking for a new SOC provider. Herba Chemosan wanted greater transparency into its Security Operations, more influence over security processes and, at the same time, access to specialized security expertise.
The goal was an operating model in which the internal security team works closely with external specialists and can continuously develop Security Operations together with them.
The key requirements included:
- Reliable 24x7 Security Monitoring
- Fast and structured handling of security-relevant events
- Transparent processes and clearly defined responsibilities
- Close collaboration with the internal security team
- Continuous development of Detection and Response capabilities
- Continued use of existing investments
- Platform flexibility to accommodate future technological developments
The Solution: Cyber Defense as a Collaborative Operating Model
Together with Swiss Post Cybersecurity, Bacher Systems established a co-managed Cyber Defense model for Herba Chemosan that combines external security expertise with the knowledge of the internal team.
Rather than starting from scratch, the existing Microsoft Sentinel environment was retained as the foundation and integrated into the enhanced Cyber Defense model. This allowed Herba Chemosan to continue leveraging its existing investments while creating the flexibility required for future development.
The Cyber Defense service includes:
- 24x7 Security Monitoring
- Threat Detection and Alert-Triage
- Incident Response
- Threat Hunting
- Vulnerability Management
- Continuous development of Detection Use Cases
- Automation and Response Playbooks
- RReporting and continuous optimization
Roles and responsibilities are clearly defined: Swiss Post Cybersecurity provides specialized SOC and Incident Response expertise, while Herba Chemosan retains the transparency and level of control it needs over its own Security Operations.
Bacher Systems combines strategic consulting and technology integration with the operational security expertise of Swiss Post Cybersecurity. The result is an integrated approach combining technology, security expertise and continuous improvement.
Implementation: Working Together Rather Than Simply Outsourcing
The implementation was carried out in close collaboration between all parties involved. Joint workshops were used to define requirements, responsibilities, relevant data sources and Security Use Cases.
Based on these findings, the existing security components were integrated, Detection and Response processes were established, and procedures for monitoring, escalation and Incident Response were aligned.
Following the technical implementation, the service was gradually transitioned into regular operations. A joint stabilization phase ensured that processes, interfaces and responsibilities worked seamlessly together in day-to-day operations.
The co-managed approach shaped the collaboration from the outset: rather than simply handing Security Operations over to an external service provider, the model was built and continuously developed together with Herba Chemosan.
With the new co-managed model, Herba Chemosan now has a powerful Cyber Defense structure that combines external security expertise with the knowledge of its own team.
The key benefits:
- 24x7 protection: Continuous Security Monitoring and structured handling of security-relevant events.
- Greater transparency: The internal security team gains visibility into processes, Use Cases and relevant security activities.
- Greater expterise: Access to experienced SOC analysts and Incident Response specialists – without having to build and operate an in-house 24x7 SOC.
- Greater involvement: Security Operations are continuously developed together with the internal team rather than being fully outsourced to an external service provider.
- Greater flexibility: Existing investments in Microsoft Sentinel continue to be utilized. At the same time, additional technologies as well as security and SIEM platforms can be flexibly integrated into the existing service.
- More value from existing data: The underlying platform can also be expanded to support additional Use Cases in the future, such as Observability, IT Service Intelligence or Data Analytics. This enables existing data sources and technology investments to deliver value beyond security.
- Continuous improvement: Detection Use Cases, automation and Response processes are continuously developed and optimized.
This has transformed a traditional Security Monitoring service into a jointly operated and continuously evolving Cyber Defense model that addresses today’s security requirements while providing a foundation for additional Use Cases and future technological developments.
About Herba Chemosan Apotheker-AG
With more than 1,000 employees across seven locations, Herba Chemosan Apotheker-AG is one of Austria’s leading companies in the healthcare and pharmaceutical logistics sector. Highly available and secure IT systems are essential to ensuring the reliable supply of pharmacies and healthcare facilities at all times.
With business-critical applications supporting logistics and core business processes, the security and resilience of the IT infrastructure play a vital role. Security Operations need to perform reliably while continuously adapting to new threats and technological developments.
Technology Partner
Swiss Post Cybersecurity AG offers security solutions developed and operated entirely in Switzerland to protect digital information. With locations in Aarau, Zurich, Morges, and Luxembourg, it strengthens its customers' cybersecurity maturity. The company was formed in 2024 from terreActive and Hacknowledge and is a subsidiary of Swiss Post.
Bacher Systems is a partner of Swiss Post Cybersecurity AG in Austria.
