Reaseheath College
Reaseheath College strengthens cyber security with Phoenix Protect – Active Response, our 24/7 SOC and Managed SIEM service.
Reaseheath College is a specialist agricultural and environmental college based in Nantwich, Cheshire. The college offers a range of full-time diplomas, T Levels, apprenticeships, and degrees for those looking for a career in the land-based industries.
The college’s small but highly capable IT team of eight is responsible for managing a complex IT estate of over 2,500 end-user devices. The devices under management include all staff laptops, tablets and smartphones, classroom environments, and approximately 500+ laptops which are made available for students to use when on campus. In total the userbase consists of 700 staff and over 4,000 students.
Key facts
- Sector: Education (Further Education College)
- Users: 700 staff, 4,000 students
- IT Team: 8 total (6 helpdesk, 2 systems managers)
- Devices: ~2,500 end-user devices
- Solutions: Phoenix Protect (24/7 SOC powered by Microsoft Sentinel)
- Environment: Hybrid (on-premises + cloud), multi-device (Windows, Apple, Android)
Like many further education institutions, Reaseheath College has evolved from a mainly on-premises IT estate to a hybrid cloud environment. While this shift has increased flexibility, performance, and scalability, it has also made the environment more complex to manage and much harder to monitor effectively from a security perspective.
With security data spread across multiple platforms, it became difficult to gain a single, clear view of risk, while the higher volume of logs and alerts being generated added to the complexity by making it harder to separate genuine threats from background noise
In summary the team faced:
- A growing volume of security alerts from multiple systems with no ability to consolidate into a single view
- Limited internal resources to monitor and respond to alerts effectively
- No ability to provide 24/7 security coverage
- Difficulty distinguishing genuine threats from noise
As a customer of Phoenix for over a decade, Reaseheath College invited Phoenix to propose a solution.
Phoenix worked closely with Reaseheath to deliver a phased, scalable security approach, evolving their capabilities over a four-year period.
The journey included:
- Phoenix Protect – Inform – an intelligent alerting service powered by Microsoft Sentinel, developed specifically for the college
- Transition to Phoenix Protect – Active Response – a fully managed 24/7 SOC with active threat response
- Continuous optimisation – monthly reviews, threat intelligence updates, and tuning recommendations
- SIEM consolidation – integrating multiple systems into a centralised platform, including custom connectors where required
This phased approach enabled Reaseheath to start small, build a compelling business case, and transition seamlessly to a fully managed security posture over time.
Phase 1: Building the business case for a SOC with the Phoenix Inform alerts service
Reaseheath initially deployed Phoenix Inform to introduce proactive monitoring and real-time threat detection across its environment. While this provided immediate visibility into potential risks, the growing volume of alerts soon placed pressure on the internal IT team.
“We were worried we were missing important alerts because we simply didn’t have the bandwidth to fully assess them.” Gareth Ferris, IT Systems & Infrastructure Manager at Reaseheath College
After 12 months, it became clear that receiving the alerts alone was not enough to ensure the college’s security. However, this initial phase proved critical in demonstrating the value of proactive security to the college’s leadership:
“By starting small we were able to test the service and build a business case for a managed SOC. The executive team could see the value of the alerts that were being generated by Sentinel, but could also see how quickly it was becoming overwhelming for us to manage by ourselves. This led to the board approving our transition to the SOC managed service.”
Phase 2: Phoenix Protect – Active Response
Recognising the complexity of running an in-house SOC, such as the highly specialist and technical skills required, round-the-clock monitoring, significant additional resources etc., Reaseheath College saw the value of transitioning to the Phoenix Protect fully managed service.
Built on Microsoft Sentinel, Phoenix Protect – Active Response provides:
- Real-time threat detection and response
- 24/7 security monitoring
- Expert-led threat analysis and triage
- Advanced incident containment
- Support for improved compliance posture
With Phoenix managing security operations, Reaseheath gained a scalable, expert-led solution without the cost and overhead of building an internal SOC capability.
Benefits (outcomes)
From hundreds of alerts per week to only critical, actionable tickets
Full coverage beyond internal working hours
Phoenix triages incidents, freeing IT staff to focus on strategic work
With centralised logging across all systems and devices, Reaseheath’s IT team know exactly where they stand at any one moment
Proactive identification of risky behaviours (e.g. insecure password storage or strange login activity)
The cost dashboards provided by Phoenix enable the college to see which activities incur the most spend, so it can target investment and training to instil best practice in its users
Regular reviews with the Phoenix security and account teams ensure continuous improvement and alignment with emerging threats
Looking to reduce alert fatigue and strengthen your cyber security posture?
Discover how Phoenix Protect – Active Response can provide 24/7 SOC capability without the cost and complexity of building your own.