Security Operations

MoD’s Defence Cyber Operations moves to new Elastic SIEM

The MoD has moved its Defence Cyber Operations team to an Elastic SIEM run with Centerprise, citing visibility gaps in legacy tools.

Radar graphic representing the Ministry of Defence's new security monitoring platform

The Ministry of Defence has deployed a new Elastic-based SIEM and analytics platform for its Defence Cyber Operations team, delivered and supported by UK integrator Centerprise International. The announcement says older SIEM tooling had fallen behind modern threats, and the replacement puts the emphasis on visibility, governance and analyst enablement rather than on yet more alerts.

What happened

On 15 October 2026 Centerprise International, based in Basingstoke, announced that, working with Elastic, it had delivered a new SIEM (security information and event management) and analytics platform for the MoD’s Defence Cyber Operations (DCO) programme. Computer Weekly reported the same day that the platform is now up and running for the DCO team.

The split of responsibilities is clear in both the company announcement and the press coverage. Elastic supplies the core SIEM technology and the senior tier of technical expertise. Centerprise is responsible for commercial delivery, day-to-day support, user enablement and governance, including orchestration and escalation between the two firms. Centerprise describes this as a tiered support model and presents it as central to the platform’s resilience.

Neither company nor the MoD has published a contract value, a procurement route or a deployment timeline, and the announcement gives no figures for data volumes, detection performance or the number of analysts using the system. What has been made public is the problem statement: MoD networks run continuously for thousands of users spread around the world, and, according to Computer Weekly, the department had found that traditional SIEM tools could not keep up with sophisticated adversaries, leaving gaps in visibility and slowing down incident responders.

The technical picture

A SIEM collects logs and telemetry from across an estate, normalises them, and lets analysts search, correlate and alert on that data. The difficulty in an organisation the size of Defence is less about any single feature than about scale and coverage. Networks carrying sensitive intelligence and military traffic generate enormous volumes of events, and if a platform cannot ingest, retain and query that data quickly, analysts end up working with partial views. That is precisely the “visibility gap” the announcement describes.

The stated goals for the new platform fall into three areas. The first is proactive defence: broader visibility across MoD networks so that malicious activity is spotted and contained early. The second is operational resilience, through simpler workflows and quicker response so that incidents do not disrupt military missions. The third is sustained value, meaning structured training, enablement and oversight so the capability adapts as threats change. Elastic’s Faith Bateman framed the aim as giving analysts a common operational picture across the whole environment and “centralising data to accelerate detection and mission response.”

According to Computer Weekly, the MoD had also found that weak governance and enablement were stopping advanced tools from delivering their full potential. That is an admission that the shortfall was not only technological, and explains why the announcement dwells on support structures.

Checklist of five security operations lessons drawn from the MoD SIEM upgrade

Why it matters for UK organisations

The timing is notable. Two days earlier, on 13 October, MI5 Director General Ken McCallum used his annual threat update to describe Russia as “aggressor number one” and to warn that it is escalating hybrid activity while staying below the threshold for a direct NATO response, according to Reuters. He also said that AI is accelerating the contest between attackers and defenders, and that Iran has shown an appetite for harder targets such as military sites. Computer Weekly placed the deployment against this backdrop of hybrid cyber-kinetic pressure on European states.

The move also fits the MoD’s own published direction. The Cyber Resilience Strategy for Defence, issued in 2022, set a target for Defence’s critical functions to be significantly hardened against cyber attack by 2026, with all Defence organisations resilient to known vulnerabilities and attack methods by 2030. One of its priorities, “Rapidly Detect and Respond”, explicitly calls for situational awareness, detection use cases, automated response, common playbooks and regular exercises. A modern central SIEM is the foundation for most of that list.

For the wider UK supply chain the message is straightforward. Defence suppliers, critical national infrastructure operators and public bodies face the same adversaries, often with far fewer analysts. If legacy tooling and thin governance were limiting the MoD’s ability to detect intrusions, it is worth asking whether the same is true in your own security operations centre.

Expert view

I have lost count of the SOCs I have assessed where the SIEM was technically capable but operationally starved. Log sources were onboarded once and never reviewed, and detection content was copied from a vendor pack and left untuned. When we run red team exercises, the most common reason a well-funded SOC misses us is not a missing product. It is missing telemetry, or an alert that fired but was never escalated because the triage process was unclear.

That is why the most interesting part of this announcement is the governance layer. Defining who tunes detections, who escalates to the vendor and who owns training is unglamorous, but it decides whether a SIEM is a detection capability or an expensive log archive. The MoD has effectively built that responsibility into the delivery model, which is a sensible design choice that private sector buyers often skip.

Caution is warranted. This is a vendor-led announcement with no public metrics, so there is no independent evidence yet of improved detection or response times. Any new platform also brings transition risk, as detection rules, data pipelines and analyst habits all have to be rebuilt. The real test will come in exercises and live incidents over the next year, not on launch day.

What to do now

The MoD’s reasoning offers a useful checklist for any security operations function:

  1. Map your visibility gaps. List the systems that do not feed your SIEM, particularly edge devices, cloud control planes, identity providers and operational technology. Coverage gaps are where intruders live.
  2. Assign ownership of detection content. Every rule should have an owner, a review date and a documented response. Retire noisy rules that nobody acts on.
  3. Write down your escalation path. If you rely on an MSSP or a vendor for advanced support, test the hand-offs in a tabletop exercise before you need them for real.
  4. Invest in analyst enablement. Budget for training and playbooks alongside licences; a platform is only as good as the people using it.
  5. Plan migrations carefully. If you are replacing a SIEM, run old and new in parallel and validate detections against known attack techniques before switching off the legacy system.
  6. Keep the basics tight. Detection is the last line, not the first. Cyber Essentials controls on secure configuration, patch management, user access control and malware protection reduce the volume of incidents your SOC must catch.

Bottom line

The MoD’s new Elastic platform looks like a significant modernisation of one of the UK’s most important defensive cyber teams, arriving in the same week MI5 warned of intensifying hybrid threats. The most instructive part is not the technology choice but the recognition that visibility, governance and enablement determine whether detection actually works. Every UK organisation running a SOC should take that lesson, and measure itself against it honestly.

Sources

Related Posts