blueAPACHE Improves Efficiency in Security Management

Summary

This case study, authored by CyberArk, describes how blueAPACHE deployed the CyberArk Identity Security Platform to protect its own business and to offer identity security as a managed service. blueAPACHE is again the customer: as a managed services provider it holds privileged access into hundreds of customer environments, and the case study explains how it replaced password vaulting without rotation or session recording with privileged access management, workforce identity, password management and vendor privileged access, then became a CyberArk MSP partner. For a buyer this is the most detailed public description of how blueAPACHE controls its own engineers' access to customer systems, which is a standard due diligence question in regulated sectors. The facts on this page come from the origin page and are attributed to it.

Key facts

Customer

blueAPACHE, described in the case study as a managed services provider offering IT management, IT strategy and converged IT services to clients across Australia, the UK, Asia and North America since 1998, headquartered in Melbourne with offices in Sydney and Brisbane. The case study frames the MSP position as the frontline: MSPs are trusted with access to client systems and data, so compromised or fake identities are the standard route for attackers.

Sector

Managed services and cyber security. The engagement is relevant to every blueAPACHE customer because it governs how blueAPACHE staff reach customer systems, and it is the basis of the identity security managed service now sold under the emPOWER Security pillar. It is cited on the financial services, government and public sector and utilities pages as third-party assessment evidence.

Challenge

blueAPACHE's General Manager of Technology describes identity security as extremely challenging for an MSP with hundreds of employees serving customers: creating hundreds of identities in each customer directory is a risk because the organisation is only as strong as its onboarding and offboarding, and with a dynamic workforce credentials can be left behind when someone leaves. The previous password vaulting tools lacked automated rotation and session recording, which made it hard to enforce identity and role controls, particularly during onboarding and offboarding. blueAPACHE also wanted stronger workforce access controls for all staff, alignment with government standards, and a platform that could extend to endpoints and non-human identities.

Solution

After a review of potential providers, blueAPACHE selected the CyberArk Identity Security Platform and used the CyberArk Jump Start Service Package and Strategic Consulting Services to implement it across a multi-tenanted environment. As described on the origin page:

• CyberArk Privilege Cloud secures privileged access to customer and internal systems with session isolation and monitoring; the platform now manages all customer support and administration access.
• CyberArk Workforce Identity gives staff single sign-on, adaptive multi-factor authentication and Workforce Password Management, so applications that do not support SSO are accessed the same way while their credentials are vaulted, encrypted and centrally managed.
• CyberArk Vendor PAM provides passwordless, VPN-less and agent-less access for remote users with privileged access, authenticating with biometric adaptive MFA and receiving just-in-time access.
• Centralised password rotation removed password ownership from individuals and eliminated credential re-use across the hundreds of credentials blueAPACHE controls internally and for customers.
• The next phase is Credential Providers (CP/CCP) and CyberArk Conjur Secrets Manager Enterprise.

At the same time blueAPACHE became a CyberArk MSP partner: large customers get a dedicated CyberArk tenant set up and managed by blueAPACHE; smaller organisations use a multi-tenanted platform. Services include provisioning and deprovisioning IT and workforce users, onboarding infrastructure and business applications into Privilege Cloud or Workforce Identity, and configuring remote privileged access with Vendor PAM.

Services used

• emPOWER Security and emPOWER Security overview: the pillar under which identity security is delivered as a managed service.
• Managed Detection and Response: identity threat detection and response (ITDR) alongside EDR and SIEM; the MDR brochure opens with "Attackers don't break in, they log in".
• Governance, Risk and Compliance: the control assessment and policy work that sits around privileged access.
• emPOWER Managed Services, emPOWER Cloud, emPOWER Connectivity and emPOWER Collaboration: the four service lines the platform is deployed across.

Outcomes

Outcomes below are as stated on the origin page (CyberArk's case study), quoted or paraphrased without addition.

The efficiency and staffing figures are estimates attributed to blueAPACHE's General Manager of Technology in the source, with no measurement period stated. The origin page also carries CyberArk's descriptions of blueAPACHE's market position and awards; those are CyberArk's words and are not repeated in blueAPACHE's own voice here. Awards that blueAPACHE reports on its own site are linked under Related.

Distinguishing internal practice from customer scope

The case describes blueAPACHE using security technology internally. It is evidence of the described approach to privileged access, not an inclusion statement for every customer security service. Identify which accounts and systems the proposal covers, who approves access and what evidence follows a change or incident. For purchased MDR, exposure management or governance work, the relevant Service Description establishes actual deliverables and responsibilities.

Sources and scope

This section connects the sources identified on this page with the KB service-scope catalogue and the terms and conditions guide. Comparison and planning points describe matters to settle for a proposed engagement, not additional service inclusions or new case-study results.

Related

• emPOWER Security
• Managed Detection and Response
• Governance, Risk and Compliance
• Exposure Management
• Human Risk Management
• Our partners
• Financial services
• Government and public sector
• Blog: Exclusive: why blueAPACHE chose to partner with CyberArk
• Blog: blueAPACHE named ARN Mid-Market Partner of the Year in the 2020 Innovation Awards
• Blog: blueAPACHE ranked among the world's most elite 501 managed service providers
• All case studies
• Contact

Frequently asked questions

Who wrote this case study and who is the customer?

CyberArk wrote it, and blueAPACHE is the customer. It describes blueAPACHE's deployment of the CyberArk Identity Security Platform across its own business and its emPOWER services, and blueAPACHE's parallel move to become a CyberArk MSP partner offering identity security to its customers.

How does blueAPACHE control its engineers' access to my systems?

According to the case study, all customer support and administration access is managed through CyberArk Privilege Cloud with session isolation and monitoring, passwords are rotated automatically, and remote privileged users authenticate with biometric adaptive MFA and receive just-in-time access through Vendor PAM. blueAPACHE states it can provide audited records of rotated passwords and session recordings to customers.

What happens to credentials when a blueAPACHE engineer leaves?

Because password ownership was removed from individuals and credentials are rotated centrally, the General Manager of Technology states that an employee leaving tomorrow would have no knowledge of the passwords or credentials used to access customer services. This was the offboarding risk that drove the project.

Which CyberArk products did blueAPACHE deploy?

CyberArk Privilege Cloud, CyberArk Workforce Identity with single sign-on, adaptive multi-factor authentication and Workforce Password Management, and CyberArk Vendor PAM. The stated next phase is Credential Providers and Conjur Secrets Manager Enterprise for application and machine secrets.

Can I buy CyberArk through blueAPACHE?

Yes. The case study states blueAPACHE sets up and manages dedicated CyberArk tenants for large businesses and runs a multi-tenanted platform for smaller organisations, covering user provisioning and deprovisioning, onboarding of infrastructure and applications, and remote privileged access. This is delivered under the emPOWER Security pillar.

What efficiency gains does the case study claim?

blueAPACHE's General Manager of Technology is quoted estimating a ten-fold efficiency increase from the credential control and automation, and that achieving the same without CyberArk could require four times more staff. These are estimates in the source with no measurement period, and are reported here as such.

How many blueAPACHE users are on the platform?

The case study states over 200 users in CyberArk Privilege Cloud, over 250 in CyberArk Workforce Identity, and hundreds in CyberArk Vendor PAM, with the platform deployed across emPOWER Cloud, Connectivity, Collaboration and Managed Services as well as internal IT.

How does this relate to blueAPACHE's compliance claims?

Privileged access controls with rotation, recording and audit are the kind of evidence a third-party assessment under APRA CPS 234, the Essential Eight's "restrict administrative privileges" strategy, or a critical infrastructure supply chain review asks for. blueAPACHE separately holds ISO/IEC 27001:2022 certification (202507-118) and states Essential 8 Maturity Level 3; neither is a substitute for asking for these access records directly.

Source

Drawn from the CyberArk-authored case study published on blueAPACHE's origin site; the vendor partner record; the emPOWER Managed Detection and Response and Managed Services brochures; and the ISO 27001 certification record and verification register. Efficiency and staffing figures are estimates attributed to blueAPACHE in the source and are reported as such.

Knowledge Base