Eliminating Redundant Security Tooling and Strengthening AWS-Native Controls for a Financial Services Organisation

The Challenge

A financial services organisation was running Trend Micro's security suite across approximately a dozen AWS accounts. The licensing and administrative overhead was significant, and much of what the suite provided - threat detection, vulnerability management, configuration compliance - had a direct equivalent already available natively within AWS, included in the platform the organisation was already paying for.

Security visibility was fragmented. Findings from Trend Micro, AWS-native services that were partially enabled, and individual account-level tooling were not aggregated anywhere, making it difficult to get a single, reliable view of security posture across the estate.

At the same time, every security log and event - regardless of severity or investigative value - was being forwarded into Microsoft Sentinel. Ingestion and data egress costs climbed in proportion to event volume, not in proportion to the value of what was actually being analysed. The organisation needed a way to reduce both the duplicated tooling spend and the Sentinel ingestion cost, without weakening detection or response capability, and without disrupting a live, audited production environment.

The Approach

Reviewing the Existing Security Stack

Pyneora conducted a capability-mapping exercise across the existing Trend Micro deployment, comparing each licensed module against the equivalent native AWS service - GuardDuty for threat detection, Inspector for vulnerability management, AWS Config for compliance and configuration drift, and IAM Access Analyzer for access risk. In every case examined, AWS-native capability already matched or exceeded what the third-party suite was providing.

Decommissioning Trend Micro

With native equivalents validated, Trend Micro was decommissioned across all approximately twelve AWS accounts in a phased rollout - confirming detection and compliance coverage was active and equivalent in each account before the legacy agent was removed. This eliminated the licensing cost and the administrative burden of maintaining a parallel security toolset.

AWS-Native Security Enablement

AWS-native security controls were enabled and consistently configured across all accounts in the estate, bringing every account to the same security baseline rather than the inconsistent, partially-configured state found at the start of the engagement.

AWS Security Hub as the Aggregation Point

AWS Security Hub was established as the central aggregation point for findings across the entire account estate, consolidating output from GuardDuty, Inspector, Config, and IAM Access Analyzer into a single, consistent view. This replaced the fragmented visibility that previously required checking multiple tools and accounts individually.

Microsoft Sentinel Cost Optimisation

Rather than continuing to forward every security event into Microsoft Sentinel, the ingestion pipeline was re-engineered to filter for high-value events only. Investigative and detection capability was preserved for the events that mattered, while ingestion and egress costs - previously scaled to raw event volume rather than security value - were reduced.

Financial outcome:

Item	Impact
Trend Micro licensing eliminated	Six-figure annual saving
AWS-native security uplift cost	Less than 10% of eliminated spend
Net annual cost reduction	Over 90% of eliminated licensing cost retained as saving

What changed:

• Trend Micro security suite decommissioned - six-figure annual licensing saving realised
• AWS-native security controls enabled and configured across approximately a dozen accounts
• AWS Security Hub established as the primary aggregation point for AWS security findings
• Microsoft Sentinel ingestion and egress costs reduced by filtering to high-value events only
• Security coverage maintained or improved across all domains
• Operational overhead reduced for the security team

Lessons for Australian Businesses

Many organisations license third-party security suites without re-checking whether the platform they already run - AWS, in this case - has since matured enough to cover the same ground natively. Paying twice for overlapping capability is a common, often invisible cost.

The same discipline applies to SIEM ingestion. Forwarding every event regardless of value drives cost in proportion to log volume, not security outcomes. A Cloud Infrastructure Rationalisation review that maps tooling against actual native capability, and filters telemetry to what is genuinely worth analysing, can uncover savings that a standard licence renewal cycle never surfaces.