Meridia Bank Cuts Incident Response Time by 73% with NGNTA

CHALLENGE: Blind Spots Between the Data Center and the Branches

Meridia's legacy intrusion detection system only covered its central data center — its 12 branch networks had effectively no traffic-level visibility at all. When something looked wrong at a branch, the only recourse was to pull switch logs after the fact and reconstruct events manually.

That gap became a serious liability as the bank scaled. A slow-moving port-scanning attempt against a branch subnet went undetected for nearly six hours before a routine log review caught it — well outside the window auditors expect for a PCI-DSS-scoped environment.

"We had good coverage at the core and almost nothing at the branches. Every incident review started with the same question: what actually happened out there? We were reconstructing timelines from switch logs days after the fact instead of watching it happen."

Without a standardized, shared view of traffic, security and network teams often disagreed about severity and root cause — slowing every response and putting compliance sign-off at risk each audit cycle.

SOLUTION: One Passive Platform Across Every Site

Meridia deployed NGNTA Pro across its data center and all 12 branches using passive taps and existing SPAN/mirror ports — with zero changes to live transaction paths and no scheduled downtime. The entire rollout, including branch installs, was completed in under two weeks.

A single centralized console now gives Meridia's security and network teams a shared, real-time view of flow data, threat alerts, and audit logs across every site. AI-driven behavioral detection baselines normal traffic per branch and automatically triggers mitigation the moment risk crosses Meridia's configured threshold — and NGNTA's REST API feeds enriched alerts directly into the bank's existing SIEM.

"It didn't feel like a security project, it felt like flipping on a light switch. One console, every branch, no gaps. Our team stopped debating what happened and started acting on what the data showed us in real time."

"Because it's passive, we didn't have to fight for a change window at every branch," Reyes added. "We tapped a mirror port, and within minutes we had live flow data. No agents to manage, no inline hardware to fail over."

RESULTS: Faster Response, Clean Audits, Measurable Confidence

With unified visibility and automated mitigation in place, Meridia's mean-time-to-contain incidents dropped from hours to minutes — a 73% reduction in incident response time in the first two quarters after deployment.

NGNTA's real-time blocking automatically stopped over 12,400 scan and probe attempts against branch and data center subnets in Meridia's first quarter live — threats that previously would have gone unnoticed until routine log review, if at all.

The bank's next PCI-DSS audit closed with zero monitoring-related findings for the first time in three cycles, with NGNTA's searchable packet-level audit trail cutting evidence-gathering time from days to a single afternoon.

"Our auditor asked for evidence of a specific alert from three months back, and we had it pulled up before he finished the sentence. That's the difference — we're not just faster at stopping threats, we can prove exactly what happened, every time."

With a lean team now able to cover 13 sites from one console, Meridia's security team is turning its attention from firefighting to proactive hardening — confident that NGNTA is watching every flow in the background.