INVESTBANK Proactively Protects Customer Data While Reducing MTTR by 80% with Recorded Future

Leading Jordanian financial institution INVESTBANK uses Recorded Future to get actionable AI-driven threat intelligence and streamline orchestration for more effective cybersecurity operations.

Goal:

Enable proactive security management and reduce mean time to respond (MTTR) with detailed threat context and improved cybersecurity orchestration.

Challenge:

Quickly accessing accurate and actionable threat intelligence from multiple sources to get ahead of threat actors who target sensitive customer data and abuse brand assets.

Outcomes:

• 14+ hours saved per week on vulnerability research
• 80% reduction in MTTR
• Increased capacity and elimination of manual tasks by automating security workflows within Splunk
• Prevention of digital risks from impacting customer relationships and diminishing brand reputation
• Prioritization of critical vulnerabilities for remediation

Security and trust form the foundation of every customer’s relationship with their bank. As a leading financial institution in Jordan, INVESTBANK can’t waver on its promise to protect its customers’ most sensitive personal and financial information—and the money they’ve worked hard to earn.

"Our goal is to ensure customers feel that INVESTBANK is a true partner," said Riyad Jazmawi, Chief Information Security Officer at INVESTBANK. "INVESTBANK is one of the most innovative banks in Jordan. We rely on digital services to provide a cutting-edge digital journey to our clients. Cybersecurity is a core pillar in our business enablement strategy."

Since its establishment in 1982, INVESTBANK has built and maintained a reputation for providing customers with premium, boutique digital banking solutions and warm, tailored customer service experiences. To preserve and strengthen this reputation, they’re also determined to provide the highest level of security.

The security team at INVESTBANK vigilantly monitors for cybersecurity threats, including misuse of the bank’s branding and critical customer data leaks. They’re also responsible for protecting customers from social engineering and phishing attempts through fraudulent websites and preventing personal banking information from being sold on the dark web.

Jazmawi’s team is under constant pressure to proactively detect and manage threats across this rapidly expanding ecosystem. Time is of the essence when it comes to detecting and resolving threats before they impact customers.

Actioning Threat Intelligence Automatically

Jazmawi and his team used to rely on open-source threat intelligence data. Although broad in scope, the data lacked accuracy and was often incomplete. It was extremely time-intensive to comb through the data and uncover quality information about relevant or pressing threats, making it challenging to mitigate vulnerabilities and take action. The time spent on this manual work also pulled his team away from other cybersecurity operations.

“We lacked visibility into what was going on on the dark web,” Jazmawi recalled. “We were unable to strengthen our cybersecurity defenses or respond to cyber threats.”

Mean time to respond (MTTR) is one of INVESTBANK’s core KPIs, and reducing MTTR is a strategic priority for Jazmawi. It’s one of the reasons they sought help from Recorded Future.

“With Recorded Future, we can mitigate cybersecurity risk, avoid unforeseen events, and take informed action in response to evolving threats faster and more efficiently,” Jazmawi said.

INVESTBANK quickly adopted the Recorded Future Intelligence Platform. The Platform indexes, structures, and analyzes data from the open web, dark web, technical feeds, and customer telemetry to automatically surface actionable insights.

Automating Security Workflows with Splunk

Improved orchestration is key for improving response times and reducing the lift of cybersecurity tasks. INVESTBANK used Recorded Future’s Splunk integration to significantly decrease the time spent on alert investigation and response — from a couple hours per day to a few minutes.

"Some activities require us to manually search the source of the connection, perform investigations, and reflect the outcomes on our security devices like firewalls. The integration with Splunk means all this is done seamlessly without any human intervention,” said Jazmawi.

The INVESTBANK team streamlines security operations workflows using pre-defined playbooks, creating seamless connections between tools and information.

“We use Recorded Future’s AI capabilities to make informed decisions when responding to evolving threats. The AI features accelerate our security operations and enable us to save time when generating reports or investigating events, allowing our analysts to interact with the platform in natural language."

Recorded Future correlates and enriches internal data with external insights to accelerate threat identification, prioritization, and remediation. Uncovering details about the most relevant threats has significantly impacted the information security team’s efforts. After switching to Recorded Future, Jazmawi’s team reduced their mean time to respond (MTTR) by 80%.

Proactively understanding the threat landscape with Collective Insights

Every financial institution is vulnerable to cyber attacks, but there's strength in numbers. Recorded Future’s Collective Insights^Ⓡ allows INVESTBANK to consolidate detections and events from their security tools in a single dashboard, connecting threat data specific to their industry and region with data from within their organization. It enables the security team to correlate data and set priorities of action based on trends and patterns.

“Collective Insights^Ⓡ has made it possible to connect the dots between the big picture of what’s happening in the wild with what’s happening in our organization to holistically understand our threat landscape. This kind of visibility helps us protect our clients better, and enables transparency and trust between INVESTBANK and our clients," Jazmawi said.

These insights extend beyond just internal visibility. "Recorded Future allows us to share relevant data about threats targeting our organization with other institutes in Jordan and in our industry," Jazmawi added. This collaborative approach allows all financial institutions to strengthen their defenses.

Catching Malicious Domain Registration in Real Time

Like many financial institutions, INVESTBANK is vulnerable to brand abuse and threat actors impersonating its executive team. The open-source data Jazmawi and his team used before Recorded Future didn’t provide reliable visibility into fraudulent domains or misuse of their brand assets. This lack of comprehensive information left the team in the dark about activity that could directly impact customers and damage their reputation.

The information security team started using Brand Intelligence, and now receive real-time notifications with detailed information regarding domains registered with a name similar to INVESTBANK. This information lets them identify malicious sites soon after they appear and issue a takedown request often before customers have a chance to interact, jeopardizing INVESTBANK’s reputation.

"Recorded Future protects our integrity and reputation by continuously monitoring the dark web for threats targeting our brand, our clients, or our top management," Jazmawi said. "We generate Watch Lists and automate Alerts to immediately address threats like social engineering, card fraud, and data leakage."

Getting proactive visibility into zero-day attacks

As Jazmawi’s team becomes more informed, they’re also becoming more proactive. The next step for the information security team was to gain visibility into potential weaknesses and prompt notifications about zero-day exploits.

One of the biggest challenges at a fast-moving organization with many digital services is maintaining continuous awareness of vulnerabilities alongside new updates and releases. INVESTBANK relies on Vulnerability Intelligence from Recorded Future to turn that challenge into an opportunity.

Recorded Future provides Alerts and context on vulnerabilities not yet widely known to the public so the INVESTBANK team can take action to secure their digital assets and protect the organization’s reputation. They also gain insights into threat actors' intentions and techniques so they can adapt quickly and fortify their defenses going forward.

Using Vulnerability Intelligence also reduces time spent reviewing and taking action against new zero-day and critical vulnerabilities, saving up to two hours a day.

“Quality data and visibility at the sector level enabled us to emphasize and enhance the collaboration with other companies in the same sector in Jordan,” Jazmawi said.

Looking ahead, INVESTBANK plans to focus on advancing AI workflows to stay ahead of evolving threats.

A collaborative partner who supports a strong cybersecurity strategy

INVESTBANK values partnership in all its customer relationships and expects its vendors to provide the same level of collaboration and support they extend to their clients. Recorded Future has proven to be a true partner to their clients by prioritizing client security and helping INVESTBANK bolster its defenses.

The partnership also empowers the security team to quantify their impact for executive leadership. "We have KPIs based on data we obtain from Recorded Future and present these to the board of directors on a quarterly basis," Jazmawi noted. "This helps the business perceive the true value of threat intelligence and how it supports achieving our business objectives.”

Without Recorded Future, Jazmawi sums up that life “would be a lot harder.” INVESTBANK would lose valuable insights and predictions that have allowed the bank to be proactive in their cyber resiliency journey.

As INVESTBANK continues to place stronger safeguards around sensitive information, their clients can better trust their data is safe and can bank with even more confidence.