How Revolut separates human-led reconnaissance from background noise
Revolut needed to know whether activity against its platform was targeted or automated. Lupovis intelligence on confirmed attacker behaviour now feeds its threat hunting workflows and gives the team a clear view of intent.
Financial services · Threat hunting
.png)
Threat hunting
Get research and insights on the vulnerabilities attackers are exploiting and what they mean for your defences.
Summary
Revolut needed to know whether activity against its platform was targeted or automated. Lupovis intelligence on confirmed attacker behaviour now feeds its threat hunting workflows and gives the team a clear view of intent.
At a glance
- Integration: Existing threat hunting and SOC workflows
- Deployment: Self-managed
- Year: 2023
Headline results
- Targeted, human-led reconnaissance identified versus automated scanning, cutting triage noise by 40%
- Compromised accounts detected early and isolated automatically
- Specific attack patterns remediated across the estate, including TOR-based traffic
The challenge
Revolut runs a fully digital bank on a highly customised in-house platform, with no physical branches and millions of transactions a day. Its detection tools showed the volume of activity it faced but gave little clarity on intent.
The security team could not tell whether Revolut was being specifically targeted, or separate human-led reconnaissance from automated background activity. The estate also changes quickly across microservices and cloud-native APIs, so any answer had to scale with it.
The solution
Lupovis worked with Revolut's security team to provide threat intelligence relevant to its platform and sector, built on confirmed attacker behaviour. The intelligence shows what adversaries are looking for and how they go about it, and it flows directly into Revolut's existing threat hunting workflows.
What changed
Revolut's team can now see early-stage targeting that traditional controls missed, and can tell a person investigating the platform from routine scanning. Threat hunters work from confirmed attacker behaviour, which has reduced noise across their workflows.
[purple-block-start]
The outcome
The same signal supports response as well as hunting. Compromised accounts are detected early and isolated automatically, and patterns such as TOR-based traffic have been remediated across the estate. Correlating the intelligence with SOC data has also improved alert quality with no extra effort from the team.
[purple-block-end]
"Having the ability to prioritise threats, understand attackers' tactics, techniques and procedures has been critical for us. Having the ability to correlate threats with what came from the SOC also helped us improve our alerts without lifting a finger."
Threat Intelligence Analyst in Finance
