ESL Federal Credit Union

Disconnected tools. Fragmented outcomes.

ESL Federal Credit Union depends on secure digital communications to support the personal, commercial, and wealth management needs of its members. Over the years, the company’s security stack evolved into disconnected point solutions for network, identity, and email, which created inefficiencies and introduced risks that could impact the business and member experience.

Key technology challenges included:

• Manual investigations across siloed tools. Security teams had to piece together alerts and activity across multiple systems, requiring time-consuming manual correlation to determine whether incidents were legitimate threats or routine activity.

• Limited context across environments. Because each tool operated independently, it was difficult to understand how threats moved across the environment-slowing detection and making it harder to assess risk with confidence.

• Inconsistent AI capabilities and lack of adaptability. Existing solutions relied on different AI models with varying levels of effectiveness, often lacking the ability to adapt to the organization's specific environment or user behavior-leading to gaps in detection and unnecessary noise.

• Growing AI adoption without enough governance visibility. With AI capabilities becoming more widely integrated into daily work, ESL looked to enhance visibility into how AI tools were being used across the organization, supporting responsible adoption, and proactively addressing compliance and data protection considerations.  

• Operational friction for security and fraud teams. Day-to-day workflows were impacted by inefficiencies such as manual workarounds, duplicate efforts, and delays in getting the right information to the right teams, reducing overall productivity and responsiveness.

“We had different tools to address different security challenges, but they weren’t working together,” explains Matthew Davis, Chief Information Security Officer (CISO) at ESL Federal Credit Union. “That created gaps, not just in visibility, but in how quickly we could respond.”  

With contracts approaching renewal, Davis took the opportunity to reassess the company’s existing cybersecurity infrastructure.

‍

Partner-led evaluation: A platform for modern security  

Rather than defaulting to incumbents, the credit union launched a competitive, hands-on evaluation across all major security domains, led by cybersecurity services expert iSECURE. “We made it clear from the start that we weren’t looking to stay with what we had. We wanted to test everything and choose what performed best,” says Davis.

At iSECURE’s recommendation, the team focused on a hands-on evaluation of their existing solutions alongside the Darktrace Behavioral Defense Platform™, prioritizing real-world performance over theoretical comparisons. As ESL’s AI usage expanded, the team also participated in Darktrace’s early adopter program for Darktrace / SECURE AI™ to understand how employees were using AI tools, and how those insights could inform internal policy, licensing, and education decisions. The evaluation process included:

• Four on-site working sessions with stakeholders
• Full platform trials across Darktrace / HYBRID NETWORK™ and Darktrace / EMAIL™
• Direct comparison of Darktrace’s solutions with incumbent tools

Based on demonstrated outcomes, ESL Federal Credit Union decided to replace its three existing incumbent tools with the Darktrace platform. “We weren’t committed to a vendor; we were committed to finding the best technology. What we found in Darktrace was a platform that could unify and strengthen everything we were trying to do,” explains Davis.

Within six months, ESL Federal Credit Union had a fully unified, AI-driven security platform spanning network, identity, email, and data protection. The project included:

• Replacing its existing network detection and response tool with Darktrace / HYBRID NETWORK™ including identity protection capabilities for autonomous prevention, detection, and response to known and unknown threats.
• Replacing the existing email security tool with Darktrace / EMAIL™ to defend against advanced and novel threats across the entire email ecosystem with Adaptive AI.
• Replacing the existing training, data loss prevention (DLP) and Domain-based Message Authentication, Reporting & Conformance (DMARC) capabilities with Darktrace / EMAIL™ to prevent sensitive data leaks, email spoofing, and brand impersonation

‍

Darktrace proves real-world performance vs. incumbents

Across each evaluation, ESL Federal Credit Union’s decision to choose Darktrace came down to one factor: how effectively each solution could understand and respond to real-world behavior.

Network security: From manual workflows to autonomous response

The existing network solution required heavy manual effort and lacked meaningful AI-driven response. “What stood out immediately during the evaluation was the difference between automation and intelligence,” says Davis. “Darktrace / HYBRID NETWORK™ wasn’t just detecting, it was responding.”

Darktrace / HYBRID NETWORK™ provides:

• Adaptive AI tailored to the environment
• Autonomous response to contain threats in real time
• Integrated identity visibility (previously missing entirely)

Email security: From rigid, limited insights to transparent, contextual AI

Its existing email security tool had numerous shortcomings:

• Continuously blocked legitimate emails, requiring security teams to spend cycles manually releasing emails daily
• Lacked in-depth visibility into why emails were flagged, making it difficult and time consuming to determine the validity of threats
• Only protected against incoming email threats, offering no defense against outbound or lateral email threats.

Additionally, the team could not fine-tune detections to reflect its environment. For example, a customer-facing fraud inbox used to collect suspicious emails from members was incorrectly treated as malicious. Legitimate reports were blocked, which required manual intervention. “Our existing email tool couldn’t understand our environment. It treated everything the same. That created real operational issues,” says Davis.

However, within two days of deploying the new platform, Darktrace’s Adaptive AI quickly adapted to this unique use case. Within days, it recognized the purpose of the fraud inbox, allowing legitimate customer submissions through while continuing to flag genuinely risky activity.

“That was the moment it clicked. Darktrace’s AI adapted to us, not the other way around,” says Davis.

Darktrace / EMAIL™ is delivering other significant results, including:

• Surfacing actionable insights for more efficient investigations
• Autonomously detecting and stopping third-party supply chain attacks
• Providing end-to-end protection across inbound, outbound, and lateral email
• Freeing the security team from cumbersome manual tasks so they can focus on proactive measures and higher priorities.

Business risk protection: From layered tools to unified platform

ESL Federal Credit Union’s existing solutions for security awareness, DLP, and DMARC added additional complexity without cohesion.

Darktrace replaced these capabilities with:

• Integrated data loss prevention (DLP) to stop accidental or malicious data exposure by identifying and stopping risky outbound communications in real time.
• Built-in DMARC and email authentication to validate email sources, block spoofed messages and provide insight into domain-level email activity.
• Unified security awareness capabilities, integrated directly into the security platform, to help educate and guide users to recognize and avoid threats.

“Instead of stacking more tools, we were able to simplify, and actually improve coverage at the same time,” says Davis.

AI security: From guesswork to governed adoption

As an early participant in the Darktrace / SECURE AI™ early adopter program, ESL worked closely with Darktrace to understand how AI was being used across the organization and where governance gaps might emerge as adoption increased.

As employees began experimenting with a growing range of AI tools, Darktrace / SECURE AI™ provided visibility the security team could not get from native Microsoft audit logs alone. Instead of relying on assumptions, ESL could review categorized activity, sensitive data indicators, and session summaries in a single view, helping the team refine its AI usage policy, uncover workarounds employees were using to access blocked tools, and guide users toward approved solutions such as Copilot. 

Darktrace / SECURE AI™ also helped ESL answer practical business questions around AI investment and governance. When executives wanted to understand whether premium Copilot licenses were being assigned to the right users, the team could use AI activity and usage insights to support more informed licensing decisions.

At the same time, Shadow AI visibility revealed employees connecting corporate devices to guest Wi-Fi networks to access blocked services such as Claude and Gemini, demonstrating that network controls alone were not enough to govern AI use effectively.

“Before we had this, we kind of guessed what types of data people were using in AI,” says Davis. “Now we actually have more clarity, and that has helped us specify what we want to prohibit in the policy.”

‍

Unified protection strengthens enterprise resilience

By consolidating multiple tools into a single platform, ESL Federal Credit Union has fundamentally changed how its security team operates, shifting from fragmented visibility and manual effort to a more unified, intelligent approach. That same model now extends to AI security, where Darktrace / SECURE AI™ gives the team clearer visibility into employee AI usage, shadow AI workarounds, sensitive data exposure, and policy adherence. In doing so, ESL has reframed cybersecurity from a collection of tools into a core component of its overall business strategy, aligning proactive protection more closely with organizational priorities and growth.

Holistic visibility across the entire threat landscape

The team now has end-to-end visibility across network, identity, email, data, and AI usage, enabling faster, more confident decision-making. Instead of piecing together signals from separate security systems or digging through Azure audit logs, analysts can understand threats and AI activity in full context, which reduces uncertainty and accelerates response.

Improved team efficiency at scale

Automation has significantly reduced the operational burden on the security team. Tasks that once required manual investigation and daily workarounds, such as triaging alerts or releasing legitimate emails, have been streamlined or eliminated entirely. This has freed up valuable time and allowed the team to focus on higher-value security priorities.

Stronger defense against high-impact industry threats

Darktrace’s Adaptive AI continuously adapts to the organization’s environment, enabling more accurate detection and real-time containment of threats as they emerge. This is particularly critical in a financial services context, where the organization must defend against sophisticated phishing, impersonation, and fraud attempts, as well as account takeover and supply chain risks. Together, these changes have strengthened both security posture and operational efficiency, delivering a more resilient foundation for the business. “Everything is now working together. That’s made our security posture stronger and our team more effective,” notes Davis.

‍

Security built to adapt and scale for what’s next

ESL Federal Credit Union’s experience highlights a broader trend in financial services: point solutions can solve individual problems, but platforms create resilience. That resilience now includes the ability to govern how employees use AI: seeing which tools are in use, identifying sensitive data exposure, informing usage policies, and supporting more confident decisions about where AI should be expanded. “This wasn’t just an upgrade; it was a transformation,” says Davis. “We went from managing tools to actually managing risk.”

By consolidating onto a single AI-driven platform, the organization gained:

• End-to-end visibility across its digital environment
• Adaptive protection that evolves with threats
• AI usage insights that informs policy, education, and licensing decisions
• Operational efficiency that scales with the business

Davis concludes: “We didn’t just modernize security, we unified it. That change has enabled us to take a more proactive approach to cybersecurity. Our focus has shifted from trying to detect threats faster to now preventing them from becoming problems in the first place.”