How we help Saarland University stay secure with our 24/7 managed SOC

The challenge

Complex IT landscapes, unmanaged endpoints, and a high-profile target for cyberattacks: few environments make IT security harder than higher education. Saarland University faced a challenge that will sound familiar to many institutions: how do you secure your networks when students, faculty, and researchers connect at all hours, from anywhere, on personal laptops, phones, and tablets that are largely outside your control?

"The challenge was that we had no unified monitoring in place. Especially in our cloud environment, we were flying blind. It was clear we needed something that could support us around the clock."

Marcel Meir, Head of Non-SAP System Management, Saarland University

The organizational structure of the university's IT added another layer of complexity. Cloud services are managed directly by the individual universities in the Saarland region, while on-premises infrastructure falls under a centralized higher education IT center.

The solution

The partnership between water and Saarland University began with a Microsoft-funded workshop to assess technical feasibility. Implementation followed immediately: Microsoft Sentinel and core Defender components were deployed as the foundation for continuous 24/7 monitoring through our managed SOC.

The value of the new setup became evident almost right away. An early security incident involving compromised student accounts sending phishing emails was detected and contained quickly, with the affected accounts locked before further damage could occur. Monitoring was then extended in a targeted way, including coverage of on-premises Active Directory structures. Integration of SAP systems and the Moodle learning platform is currently underway.

Throughout, one priority remained constant: protecting digital identities. In a university environment where endpoint control is inherently limited, sign-in behavior, authentication logs, and identity risk signals become the most reliable early warning system available.

"Identity protection is the key feature for us. By centralizing sign-in logs, we can detect compromised accounts, protect our systems from them, and keep everything secure for everyone else."

Marcel Meir, Head of Non-SAP System Management, Saarland University

The collaboration itself also had to fit the university's reality. A rigid, one-size-fits-all onboarding approach was never going to work given the complexity of the environment. What mattered was a solution built around the university's specific needs.

"We haven't found a single service that water couldn't connect. That flexibility was decisive for us. On top of that, we can reach the right experts quickly when we need to. That was another key reason we chose water as our partner."

Marcel Meir, Head of Non-SAP System Management, Saarland University

The benefits

Today, Saarland University has significantly greater visibility into security-relevant events. Compromised accounts, suspicious logins, phishing activity, and spam distribution can be detected and assessed faster than before. At the same time, water's 24/7 monitoring relieves the internal team of a workload that would be difficult to sustain with in-house resources alone.

That visibility also translates into concrete operational improvements: streamlined processes, automated responses, and faster risk remediation. There is another benefit worth noting. For students, faculty, and researchers, the new security architecture remains largely invisible.

"In the best case, our users won't notice at all that we've become more secure. That was also our goal: more security in the background, with as little friction as possible."

Marcel Meir, Head of Non-SAP System Management, Saarland University

Saarland University now has a solution that fits its reality: flexible, identity-centered, and active around the clock.