How Grainger processed every alert through a 4,000% surge with TENEX.AI

When J.P. Calabio looked at Grainger's security environment, he could see about two-thirds of it. The rest wasn't sending data. That gap mattered because Grainger keeps industry running, and an attack on a core system like HR or ERP could cripple the business.

J.P. had given his team one mission: be the first cyber responder. That mission needed full visibility, and full visibility meant far more data than any team could work by hand. So Grainger went looking for a platform and a partner built for that load. It chose Google SecOps as the platform and TENEX.AI as the MDR running on top of it.

Blind spots, noise, and more data than the team could handle

Grainger faced three problems at once. Large parts of the environment weren't ingesting data, so threats there went unseen. The data that did come in produced too many false positives, which buried analysts in noise. And closing the visibility gaps would multiply the volume.

“When I looked at the current environment, I only had visibility into maybe two-thirds of it,” J.P. said.

A legacy MSSP model couldn't absorb that kind of growth. As Edwin Solis, Co-Founder and CRO of TENEX.AI, put it: “Legacy MSSPs just could not keep up with that.”

Built for speed and scale on Google SecOps

Grainger built its security operation on Google SecOps, with a single data lake for enterprise-wide telemetry. SOAR automates response. Mandiant Frontline Threat Intelligence correlates the newest threats against all of Grainger's data, which gives the team early warning before an attack lands. Gemini in Google SecOps helps analysts get productive on the new platform faster.

“It has really reduced the learning curve for our security analysts,” J.P. said.

TENEX.AI runs on top of Grainger's Google SecOps instance, which stays the system of record. It works with existing YARA-L rules and UDM parsers. Specialized AI agents triage, group, investigate and document every in-scope alert. A named TENEX.AI analyst owns every consequential call.

"Being able to implement automated response with SOAR, and to use an MDR like TENEX that can handle that scale, took away a lot of the noise."
J.P. Calabio

Holding up when it counted

The real test came as visibility expanded. Alert volume rose about 4,000%. Grainger's team processed every alert that came in, lost no effectiveness, and kept meeting or beating its KPIs against industry benchmarks.

TENEX.AI made that possible by working every in-scope alert to a verdict instead of sampling the volume down. Agents absorbed the triage load, so analysts spent their time on decisions. Attackers now use AI and move laterally in seconds, and Grainger's defense now moves on the same clock.

Scaling with Grainger

Grainger is still expanding visibility across the whole enterprise, on a platform built for the speed and scale that comes with it. Each new data source adds volume, and the operation is designed to take it on. The team keeps working toward J.P.'s mission of being the first cyber responder.