"Our SIEM and EDR give us alerts and telemetry, but Binalyze AIR gives us visibility. With AIR, we get the full picture—what executed, what moved, what was accessed—and that’s what helps us close investigations with confidence.”

Company Overview

Thrive is a leading provider of NextGen managed services, delivering secure, scalable, and innovative solutions to small and mid-sized organizations.

With a dedicated 24/7/365 Security Operations Center (SOC), Thrive offers robust Threat Detection and Response services, including Managed Detection and Response (MDR) and Managed EDR, to ensure continuous protection and visibility.

In addition to proactive monitoring, Thrive supports its customers with tailored incident response and remediation capabilities designed to minimize disruption and accelerate recovery.

From alerts to answers: the missing link in IR

As Thrive’s 24×7 security offerings matured, so did customers’ expectations. Having built strong relationships through its MDR services, Thrive increasingly found that customers wanted more than alerting—they wanted answers. Fast.

Previously, when serious incidents occurred, Thrive’s SOC would escalate and hand off cases to their customer’s third-party DFIR provider. While this approach could get results, often introduced delays and fragmented the customer experience. The Thrive team, who already understood the customer’s environment intimately, had to step aside while an external team started from scratch.

“Our engineers knew the customer environment, their users, their pain points,” said Kevin Landt, VP of Product Management at Thrive. “But once a third-party DFIR provider stepped in, valuable time was lost—and that’s when customers need clarity most.”

Thrive’s SOC leveraged powerful detection tooling like EDR and SIEM platforms to support its MDR services. These tools offered high value in alerting and monitoring, but lacked the forensic depth needed to answer key questions—like how an attacker got in, what they did, and how far they moved. They weren’t designed for evidence collection or deep investigation at scale.

It became clear that Thrive could close that gap. As demand grew, the leadership team quickly realized they needed tooling that could help them own more of the investigation process—faster, and at scale. They explored open-source and commercial platforms, but many came with trade-offs: steep learning curves, slower time to value, and workflows that forced analysts to work in isolation.

Building a faster, smarter response capability

With a clear goal to close the investigation gap and deliver a more seamless experience for customers, Thrive launched its Incident Response Retainer—an add-on service for existing managed customers.

Designed to extend their 24×7 security operations with complete response services powered by Binalyze AIR.

The team uses AIR to collect artifacts, create and assess timelines, identify indicators of compromise, and conduct detailed triage and threat hunting across impacted systems.

AIR’s unified Investigation Hub brings the entire workflow—detection, analysis, and reporting—into a single interface. This has helped Thrive streamline investigations, accelerate time to insight, and elevate the consistency and quality of reporting delivered to customers.

“We’re often able to provide key findings within an hour,” said Clark. “Even with customers who aren’t pre-deployed, we’re usually delivering solid insights within four hours.”

This speed allows Thrive to de-escalate tense situations quickly—often well before third-party DFIR providers, brought in by customers as part of their cyber insurance policies, begin their work.

One of AIR’s standout capabilities is its ability to surface conclusive evidence that enables the team to validate execution, trace attacker movement, and confidently report findings. Thrive also makes extensive use of AIR’s Triage engine to extend investigations—applying custom rules based on threat intelligence and case-specific indicators to hunt across systems and close out any lingering gaps.

“Our findings have stood up to review by third-party forensics teams,” Clark explained. “In some cases—especially when insurers are involved and bring in their own DFIR vendor—those teams have reviewed our collections and chosen to use them rather than start over.”

AIR’s remote shell capability, interACT, is another critical feature. Thrive uses it frequently for post-compromise access, particularly when adversaries have changed credentials or restricted normal access.

It’s become an essential tool for conducting AD audits, executing tools, and regaining visibility in compromised environments. Thrive’s use of AIR has powered successful outcomes across a wide range of incidents, enabling quicker investigations, stronger reporting, and more resilient responses.”

Outcomes: From deep investigations to faster recovery

Binalyze AIR has transformed how Thrive delivers incident response. AIR empowers the team to investigate more thoroughly, respond faster and operate with greater assurance.

For customers, the difference is immediate: faster answers, clearer communication, and reduced downtime. Thrive now delivers key findings within hours of an incident, compressing timelines that previously stretched into days—especially in cases involving external DFIR providers. Clark explained, they’re “not just telling customers there’s a problem—we’re showing them exactly what happened, how it happened, and what to do next.”

That clarity accelerates the path to recovery. AIR helps Thrive move swiftly from investigation to remediation, arming customers with conclusive evidence and structured reports that streamline communication with legal, compliance, and insurance teams. EVP of Security Operations at Thrive, Audy Bautista, shared that they’re “now able to go deep into investigations and, in a short time, get to the point where we’re talking about recovery and remediation.

That’s real value—for the customers and across the business.”

Internally, AIR has also allowed Thrive to scale more efficiently. The success of the IR Retainer has expanded the company’s footprint with existing customers and unlocked new growth opportunities. What started as a capability gap has become one of Thrive’s fastest-growing service lines. “This has been one of our most successful launches,” said Landt. “Our customers remember how we showed up when it mattered most.”

Conclusion

Thrive’s partnership with Binalyze has redefined how incident response is delivered at scale, delivering conclusive analysis and rapid execution to meet the demands of today’s customers.

With AIR embedded in its IR Retainer, Thrive has turned a critical capability gap into a high-growth service line that’s delighting customers and driving business momentum.

“Our team continues to be better prepared, faster, and more effective,” said Bautista.