About Infor

Infor is one of the largest enterprise software companies in the world, over twenty thousand employees serving more than 60,000 customers across 175 countries. The company runs overwhelmingly on AWS, spanning thousands of AWS accounts across over a dozen regions, and its regulated SaaS workloads generate tens of terabytes of security telemetry a day, a scale few enterprises ever see. Securing that estate is a talented global security organization led by CISO Derek Bush.

The opportunity

Infor’s security telemetry lives where regulation says it must. India requires logs to stay in the region, Europe is moving the same way, and Infor’s answer was to make Amazon Security Lake its security system of record, with multi-region instances that keep data where it is generated. That choice protects compliance, but it breaks the assumption every traditional SIEM is built on: that logs get centralized before they get analyzed. With AWS CloudTrail alone producing many terabytes of data per day, moving the data was never an option, and tools that required it were off the table.

The challenge

The team also had a capability gap it wanted to close. Detection existed at points across the estate, but there was no continuous, active threat hunting: no way to hunt for novel, AI-powered threats or take each day’s new threat intelligence and ask, across the whole environment and its history, whether Infor was exposed. Answering that question manually across a multi-region estate at Infor’s scale with traditional tooling was slow and expensive. Rather than settle for the incumbent playbook with the traditional SIEMs they had, the team went looking for a way to leapfrog it.

The solution

Artemis connects to Infor’s Security Lake in a federated manner, querying the data in place. Detections, aggregations, autonomous investigations, threat hunts, AI Mode, and environment intelligence all run over the lake, in every region, directly on OCSF. Raw logs never leave Infor’s accounts or regions; only investigation summaries cross the boundary. The compliance posture the lake was built for stays intact, and Infor pays to store its telemetry exactly once.

On that foundation, Artemis learns the environment, building behavioral baselines for the identities, service accounts, and workloads spread across more than 8,000 AWS accounts, so anomalies are scored against each entity’s own history instead of a generic rule.

And it hunts continuously: hypotheses adapted to Infor’s unique environment and new external threat intelligence triggers IoC and TTP hunts across the environment and its history, paired with forward-looking detections that keep each threat covered after the hunt completes. When a hunt hits, it opens a case backed by an evidence-cited investigation. When something feels off, analysts launch their own hunts in natural language.

How Infor uses Artemis

Day to day, Infor’s SOC analysts work cases, query their own data, and run investigations in AI Mode, with Security Lake coverage correlated against identity, endpoint, cloud, and network telemetry from sources like their IdP, EDR, cloud, and network security tooling. Triage that used to mean pivoting across consoles now starts from a case that arrives already investigated.

For an enterprise software vendor at the top of its customers’ supply chain, the question that matters most arrives with every industry headline: are we affected? Answering it used to mean days of manual work across regions. Now every new advisory and intelligence report becomes a hunt across all of Infor’s regions, current and historical data alike, within hours of publication, and analysts get an evidence-backed answer within minutes. Precision comes from context: because Artemis baselines every identity and service account across more than 8,000 accounts, it recognizes when activity is genuinely out of character for that specific identity, in any region. The same muscle keeps the estate tidy, flagging unsanctioned remote-access software and new technology handling secrets, including AI coding agents on developer endpoints, before any of it becomes exposed.

Results and impact

Infor went from manual, point-in-time checks to threat hunting that is always on, across a heavily regulated global estate, without moving a single log. The question that used to take days of manual work across regions is now answered in minutes, with the evidence attached, and the SOC spends its time making decisions instead of building context.

The numbers underneath: when Artemis went live against the full production environment, it processed 22 billion events and distilled them into tens of cases inside the first 36 hours. Over its first 90 days the platform ran more than 10,000 autonomous investigations and 1,000 threat hunts, work that would otherwise have consumed many thousands of analyst hours.

Suspicious findings feed back into coverage: when the team validates activities, Artemis automatically turns them into detectors tuned to Infor’s environment, so any future potential security event will be easier to catch. And as data-sovereignty regulation keeps expanding, Infor’s detection architecture is already shaped for it. The data stays put, and the analytics come to the data.

Get started with Artemis

Regulation increasingly decides where security data can live, and detection has to work with that rather than against it. Artemis learns your environment, queries your data where it lives, hunts continuously as new threats emerge, and investigates every alert with the reasoning and evidence attached. See what Artemis can do in your environment and request a demo at artemissecurity.com.