MERGE: Unifying Multi-Cloud Security Operations | Foresite

PROJECT

Legacy SIEM displacement and managed security operations across a multi-cloud estate

SERVICES DELIVERED

Catalyst Citadel MXDR, Assessment, Migration, Vulnerability management, Penetration testing

GOOGLE PRODUCTS

Google SecOps, Security Command Center Enterprise, Google Threat Intelligence

CLIENT

www.mergeworld.com

INDUSTRY

Marketing & advertising technology

COMPLIANCE DRIVERS

HITRUST, SOC 2

TAKE IT WITH YOU

The two-page MERGE case study, formatted for sharing internally

Download the PDF →

The Challenge

A hard deadline and a fragmented estate

MERGE runs a complex multi-cloud environment spanning Azure and Google Cloud. Their incumbent SIEM and SOC contract was expiring, which set a firm date to migrate rather than an aspiration to modernize.

The requirements went well past a like-for-like replacement:

Unified visibility across more than fifteen log sources spread over two clouds
Compliance-grade evidence that would stand up to HITRUST and SOC 2 requirements
A partner, not a vendor — someone to advance the security program, not just operate a new tool
No gap in coverage during the cutover

The Solution

Prove it first, then migrate

Foresite structured the work in phases so MERGE could see value before committing to a full platform move.

Assess
A Google Workspace and Google Cloud security assessment established the baseline: what was covered, what was not, and where the blind spots sat.
Prove
A scoped proof of concept validated Google SecOps against MERGE's real telemetry and real detection requirements, before any contract decision.
Migrate
A full migration to Google SecOps, delivered under Foresite's Catalyst Citadel MXDR service. Foresite handled parser development, telemetry integration through BindPlane, and detection engineering across the log estate.
Extend
Security Command Center Enterprise centralized cloud security posture management across both clouds. Google Threat Intelligence enriched detections. Managed vulnerability management and offensive security testing carried the program past SIEM into continuous security operations.

Practitioner-governed, human in the loop

Autonomous investigation runs at machine speed. Named Foresite practitioners validate every high-impact action before execution. Agentic never means uncontrolled.

Abstract image of navy, bright blue and orange

“We have a full-time SOC that is triaging alerts, doing all the detections and responding and escalations when needed, for governance, risk and compliance and maturing our security program.

And that's the real ROI for us, because then we're really able to focus on providing that whole human value to our clients.”

Roze San NicolasDirector of TechOps, Information Security, MERGE

The Outcome

One platform, one team, across two clouds

MERGE now runs a single security operations platform across its entire multi-cloud footprint, operated by Foresite.

Unified visibility. Telemetry from across Azure and Google Cloud lands in one platform, giving the team a view they did not previously have.
Compliance evidence in one place. SCCE centralizes posture and audit evidence in support of MERGE's HITRUST certification goals.
Operational weight lifted. Foresite's managed service runs detection and response, so MERGE's team is accountable for direction rather than console time.
The scope kept growing. What began as a SIEM migration is now a multi-year program spanning detection and response, cloud posture, vulnerability management, and penetration testing.

In this conversation, Joe McGee (Security Operations Manager at Copado) and Jeremy Hehl (VP of Business Development at Foresite) discuss how they partnered to operationalize security across Copado’s DevOps pipelines and containerized workloads.

Using Google SecOps, Security Command Center Enterprise, and Gemini AI—delivered through Foresite’s Catalyst Bridge platform—Copado achieved real-time detection, full-stack visibility, and a transparent, scalable security model without compromising customer trust.