SixDegreesConsulting@kuraldesign.com

How understanding your investment can lead to greater visibility and control

When an enterprise recently moved its operations to the cloud, the security landscape became more complex. Multiple vendors, staffing shortages and inconsistent control coverage all contributed to fragmented security. The company came to Six Degrees Consulting wanting to understand how well its security was working. Our approach began with a fundamental question: What if financial modeling could reveal better security options?

SDC understands how financial clarity can often expose technical risks, cost savings and unseen opportunities. To untangle the complexity, SDC helped structure a five-year operating cost model that compared ongoing vendor support expenses with total acquisition and deployment costs. This wasn’t only about balancing the budget; it was also about showing how vendor sprawl can create higher costs and, in some cases, lead to higher risk. When teams are stretched across too many systems, overall security posture becomes inefficient, coverage weakens and response time slows.

A financial cost model for security efficiency

By mapping every product, contract and capital cost in play, SDC was able to develop a holistic view of the enterprise’s current security ecosystem. A quantifiable model illustrating operating costs uncovered several gaps—some that had surfaced during the enterprise’s rapid cloud migration. Further consultation revealed a fuller picture: The overlap of multiple security products had strained IT resources, creating staffing inefficiencies and higher costs from maintaining several vendor relationships.

Turning insight into action: the hybrid mesh advantage

The financial model revealed that consolidating security under a unified management plane—a hybrid mesh firewall—would deliver stronger control, simpler operations and better ROI. A hybrid mesh platform uses a single dashboard to manage firewalls, especially during configuration and rule changes, as in this case. The unified system also provides coordinated protection across IT environments, integrating multiple firewall features to secure an enterprise’s distributed network while maintaining full visibility and control. Shifting to a single-vendor solution would also reduce overall costs.

After implementation, the unified approach cut training expenses and enabled the company’s existing staff to manage security more effectively. The hybrid mesh service provided continuous monitoring, threat prevention and automated updates—all with predictable expenses—offering the enterprise the flexibility and coverage it needed to continue to grow and scale. As a result, deployment time improved, training complexity dropped and internal teams were free to focus on other strategic priorities. The project closed ahead of schedule and on budget.

The takeaway: Security strategy isn’t just a technical challenge, it’s also an economic one. When organizations observe their security investments through the same analytical lens they use for other business initiatives, they position themselves to strengthen both their defenses and their bottom line.

Transitioning away from a managed services provider

Managing large-scale security and data migrations is a common process, particularly after acquisitions. It’s a scenario Six Degrees Consulting encounters often. In this case, a managed services provider (MSP) had been overseeing an enterprise’s security, network and data center. The enterprise was recently acquired and its new parent company wanted to bring those functions in-house. Management hoped for a smooth transition. When communication from the MSP faltered, the enterprise turned to SDC to step in, stabilize the handoff and guide the move.

Building security and trust through project leadership

The enterprise needed a fresh start and a clear path forward to build its own engineering and operations teams. Ideally, its current MSP would have been a key presence as the transition got underway. In reality, the MSP did not provide key configuration details—vital information that could put a successful migration at risk.

SDC began with an extensive network discovery. Reviewing documentation and IT help tickets provided insight into the company’s overall security environment. Acting as both project manager and technical consultant, SDC mediated between the MSP and the enterprise to create a transfer plan that included staging, defining system requirements, and implementing and deploying backup firewalls.

Automation = Stabilization

Automation strengthens security through reliable threat detection and response software. It reduces human error and boosts efficiency by freeing IT teams from repetitive tasks. For enterprise-level security, automation enhances compliance through continuous monitoring and reporting while cutting alert fatigue by filtering false positives. In this case, SDC advised and utilized automation software for consistency, efficacy and performance. By reducing manual effort, especially during the configuration and rule changes, automation could manage and monitor firewalls with greater precision and speed.

SDC established requirements to replace the MSP-owned firewalls. The enterprise then tested and implemented automated firewall management. Under SDC’s guidance, it staged, re-tested, and deployed auxiliary firewalls for the full ownership transfer. Finally, once new firewalls were in place, the enterprise was able to expand and train its IT team and transition without unnecessary risk.

Real-world scenarios

Organizations moving away from an MSP need continuity without disruption, especially when adapting to a new environment. Automation can enhance efficiency and reduce threat, while ensuring security products deliver their full value. The result is consistent protection, faster recovery and a measurable reduction in executional risk.

Protecting teams and data as communication shifts to cloud workspaces

Cloud-native platforms like Microsoft 365 and Google Workspace deliver core services, collaboration tools, and built-in efficiencies such as cost savings, scalability and simplified IT management. Yet as they transform how teams work, they also introduce new challenges in data security and identity protection. Cloud-based email can strengthen remote work and reduce infrastructure demands, but relying solely on a provider’s defenses can leave security gaps—making layered protection vital to safeguarding communication.

Protecting endpoints through defense layers

A business customer approached Six Degrees Consulting after retiring its data center–based email, eliminating the need for servers, storage, firewalls and antivirus software. After moving to a cloud-based provider, management noticed an uptick in spam, phishing and malware activity. The cloud-based service, which already provided safeguards and infrastructure, offered a security upgrade at an additional cost. But still, the breaches continued, and the latest upgrade introduced a new issue: numerous false positives. It was incorrectly flagging harmless activity as a threat, which disrupted employee workflows and strained the help desk.

Securing the cloud-native workplace

The security illusion of cloud-based email stems from the belief that broad platforms can fully protect users from threats. Ideally, cloud email should follow a shared responsibility model, in which providers secure the cloud infrastructure while customers secure their own data and users within it. Not fully understanding this sharing can expose organizations to targeted attacks that evade even the most comprehensive built-in protections.

Layered security for cloud-based providers

SDC recommended a layered security approach to protect the business in its new cloud-based phase. By introducing a high-performing, cloud-native email and collaboration solution, SDC demonstrated how malicious content could be scanned and blocked before it reached users’ inboxes. The rollout began as a pilot to validate performance, then expanded to higher-risk user groups for a broader demonstration.

The results spoke for themselves: reduced spam and phishing incidents, fewer false positives, and measurable time savings for IT. The business avoided investing in additional security tools from the provider and cut costs while lowering its attack exposure. The upfront trial proved the solution’s effectiveness, building confidence ahead of full deployment. Partnering with SDC from the start streamlined onboarding and ensured a smooth transition.

The takeaway: Solutions like Microsoft 365 and Google Workspace offer strong protections, but as multi-tenant systems, their shared infrastructure inherently increases risk. A single misconfiguration, phishing campaign, or integration gap can bring unwanted exposure. Collaborative models strengthen security on the platform but not always for data or identities. To stay protected, businesses need layered defenses for stronger visibility and threat prevention, along with employee training and confident endpoint protection.

The evolution to API-based email security

The worldwide pandemic reshaped the core of enterprise collaboration. As organizations rushed to Microsoft 365 for seamless cloud productivity, many carried over legacy security tools that were not designed for a borderless, cloud-native workplace.

In one case, a company relied on a traditional secure email gateway (SEG) positioned in front of its on-premise email system. When it migrated to Microsoft 365, integrating the two created new problems instead of improving protection. Because the SEG sat between employees and Microsoft’s built-in defenses, it prevented Microsoft from fully detecting and blocking threats. Microsoft 365 is designed to stop a high percentage of spam and phishing emails using insights from billions of global signals each day, so the company was paying for top-tier protection it couldn’t fully leverage. The result was a setup where neither system worked optimally, leaving IT teams to manage outdated tools, inconsistent filters and frustrated users—all while their workload continued to grow.

API-enabled platform for proactive defense

SDC launched a demo and trial of an advanced tool—Check Point Email & Collaboration—to clearly demonstrate its impact. It is an Application Programming Interface-based email and collaboration platform designed to operate within the cloud ecosystem, not in front of it. By plugging in, Email & Collaboration continuously scans messages, shared files, and user interactions using the provider’s own data.

By starting in detect-only mode, SDC could allow existing email to flow freely while also collecting data on spam, phishing, malware and other anomalous activity touching user inboxes. These initial insights prompted a trial extension to a group of highly targeted users. Results from this second trial gave management the confidence to approve a full rollout, which quickly delivered measurable gains. The company saw lighter strain on email defenses, less IT remediation, fewer disruptions, and far fewer phishing and malware incidents.

This real-world example underscores a larger truth: the perimeter-based security model doesn’t always fit the fluid nature of cloud collaboration. Tools like Teams, OneDrive and SharePoint expand how people share and store information, but in doing so, they also expand attack surfaces. As users add content to chats and shared folders, traditional email gateways lose visibility and security gaps widen. API-driven defenses connect directly to the cloud, preserving native protections while adding continuous monitoring, behavioral analytics and automation.

Achieving more from unified cloud-native email security

Security is not static—it’s a complex system that evolves alongside communication. Modernizing from legacy SEGs to API-based data and identity protection brings many advantages. It enables higher detection accuracy, and provides measurable improvements to user experience and alignment with Microsoft’s native security controls. Messages can be scanned, re-evaluated and remediated in real time, streamlining the user experience and raising overall efficacy.