Case Study: Visa cuts alert triage from minutes to seconds with Elastic Security Workflows

Visa cuts alert triage from 10–20 minutes to seconds with Elastic

Visa, a global payments network, faced a significant challenge in its security operations. As part of a migration from a legacy SIEM, the company needed to reduce the time analysts spent triaging a specific, high-stakes mainframe alert. Each alert required a manual, secondary search that could take 10 to 20 minutes to identify the responsible user, a process that varied in speed and quality depending on the analyst's experience. To address this, Visa partnered with Elastic to build a more efficient and consistent process using Elastic Security and Elastic Workflows.

The solution implemented by Elastic was a four-stage automated workflow. This pipeline used Elasticsearch Query Language (ES|QL) for detection and enrichment, followed by a controlled AI step to validate the findings and produce a structured summary, which was then delivered via webhook to the incident response team. The results were dramatic, reducing triage time from minutes to seconds. The automated workflow by Elastic also standardized the process, removing dependency on individual analyst expertise and creating a reusable pattern for other security detections.

Visa