Best Buy pairs Microsoft Security solutions with Tanium for more visibility and ease

Security is Best Buy’s watchword for advancing its mission of enriching lives through technology. But protecting a complex digital environment required real-time, comprehensive visibility not possible with its previous disparate security tool set.

Best Buy added Microsoft Defender for Endpoint to connect with its existing Tanium endpoint management solution. It ingests data from Tanium into Microsoft Sentinel, which the company adopted as its security information and event management system.

Best Buy’s single point of truth visibility decreased time to insights and reduced log ingestion time by 20% across the environment, saving hundreds of hours of security team time. And the company’s robust overall security is a win for everyone.

Enriching lives through technology

As one of the world’s largest specialty consumer electronics retailers, Best Buy delivers on its purpose to enrich lives through technology. With more than 1,000 stores across North America, in addition to a robust online presence, the retailer is providing shoppers with a unique mix of advice, products, and services to help meet their everyday needs.

At the same time, Best Buy also has a data-rich, 120,000-endpoint environment. Five different tool sets complicated security—until the company shifted its focus to consolidation and found the best of all worlds: Microsoft Security solutions interoperating with Tanium, a real-time endpoint management platform.

Breaking the security system silo barriers

Supporting a complex, multicloud environment accessed by more than 80,000 employees and millions of customers exacts obvious challenges on a security team. Best Buy’s multivendor tool set complicated that work. As Best Buy’s Senior Director of Technical Operations and Engineering, Mike Eyre oversees the engineers who managed that disparate tool set across multiple environments and teams. “Not only did my team have to repeat tool deployment and maintenance time for every solution,” he explains, “the incident response teams had to navigate multiple consoles to gain a clear overall security status.”

Years of security advantages gained with the Tanium threat response tool led to Best Buy replacing multiple third-party tools with more performant Tanium modules. As part of that consolidation, Best Buy evaluated Microsoft Defender for Endpoint. “After deploying Defender for Endpoint, we quickly expanded into the rest of the Microsoft stack,” says Eyre. “The combination of Defender for Endpoint and Tanium gives us detailed security data that we might not otherwise have.”

“Tanium and Microsoft are the front line for prevention and detection throughout our organization.”

Adam Mishler, SVP, Global CISO, Best Buy

The next step would be to coalesce data into one source of truth—an innovative, AI-powered security information and event management (SIEM) solution that easily scales to the demands of a large and complex environment. Best Buy chose Microsoft Sentinel.

Consolidating visibility with Microsoft Sentinel

The preponderance of logs coming into the previous SIEM created concern that alerts might be missed. Best Buy’s Microsoft Sentinel deployment turned the situation around. “Thanks to our Microsoft Sentinel and Tanium stream, we can ingest 25 TB of data a day into Microsoft Sentinel,” says Eyre. “That’s an increase of 15 TB daily over the previous solution.”

“The automation that we’ve introduced to our security stack via Defender for Endpoint, Tanium, and Microsoft Sentinel has propelled our security posture light years ahead of what it was five years ago.”

Mike Eyre, Sr. Director, Technical Operations and Engineering, Best Buy

Matt McCullough, Senior Cybersecurity Detection Engineer at Best Buy, agrees. “The scale and ease of visibility that we are achieving with Tanium and Microsoft Sentinel is helping us become a defensive powerhouse. My colleagues and I have much more time to dive deeply into improving our detections, making them richer and more high-fidelity,” says McCullough. Adds fellow Security Engineer Jesse Brown: “By joining our Microsoft and Tanium tools, we’ve reduced our time to resolution on alerts by 20%.”

Protecting the front line, every day

Adopting a unified security platform is allowing Best Buy to remain focused on its mission to enrich lives through technology.

“We’ve ingrained security in everything our people do, and we’ve given them the most consistent, interoperable tool set possible,” says Adam Mishler, SVP and Global Chief Information Security Officer at Best Buy. “Tanium and Microsoft are the front line for prevention and detection throughout our organization. I think automation and AI are going to be incredibly impactful for Best Buy.”

“The scale and ease of visibility that we are achieving with Tanium and Microsoft Sentinel is helping us become a defensive powerhouse. My colleagues and I have much more time to dive deeply into improving our detections, making them richer and more high-fidelity.”

Matt McCullough, Sr. Cybersecurity Detection Engineer, Best Buy

It’s also a proud moment for Best Buy’s security teams, too.

“The automation that we’ve introduced to our security stack via Defender for Endpoint, Tanium, and Microsoft Sentinel has propelled our security posture light years ahead of what it was five years ago,” says Eyre. “Our security engineering teams are in full support of our mission with a unified security set.”

Discover more about Best Buy on Facebook, Instagram, LinkedIn, X/Twitter, and YouTube.