Cuts security alert noise by 83% using Google Security Operations
Saves 650+ hours of triage effort for a lean internal IT team
Delivers 24/7 SOC coverage from StickmanCyber without local IT hires
Extends Google Workspace log retention past 30 days using BigQuery
Protects distributed staff on unmanaged BYO hardware through Chrome Enterprise Premium
The Conversation teams up with Google Cloud to cut security alert noise by 83% across its global network.
The Conversation teams up with Google Cloud to cut security alert noise by 83% across its global network.
Safeguarding independent journalism
across global time zones
Global news non-profit The Conversation operates 13 regional editions across every major time zone, pairing professional editors with academic experts to deliver independent research and news.
Operating with a lean IT department where staff is over 90% editorial, every technology decision is weighed against the organization's core journalism mission. Building dedicated, in-house security teams in every country was financially unfeasible, as hiring internal IT personnel directly reduces resources available for editorial newsrooms.
However, a global publishing model exposes the organization to unique threat vectors. Beyond standard cyber threats, newsrooms face increasing attacks from hacktivists and state-linked espionage aimed at journalists, particularly because staff often hold sensitive, embargoed government information. Additionally, a significant portion of distributed remote staff relies on unmanaged BYO hardware, introducing risk across international jurisdictions. The Conversation needed a centralized, 24/7 security function capable of protecting newsrooms in real time without adding operational overhead or forcing regional hiring.
To address these challenges, the organization evaluated security platforms and selected Google Security Operations (SecOps) alongside managed security partner StickmanCyber. Because The Conversation already ran its infrastructure on Google Cloud through Google Workspace and Google Cloud, Google SecOps provided broad visibility across its existing technology environment with minimal internal setup. StickmanCyber handled additional log tuning and integrations for other applications.
Turning on a single integration within Workspace and Google Cloud captured visibility of pretty well everything within the organization immediately. Because of our existing technology stack and limited IT resources, the speed and ease of implementation made SecOps a pretty easy choice for us.
Kim Bell
Director of Information Technology, The Conversation
Building a persistent reasoning engine
on Google Cloud
The Conversation established unified visibility across global operations by feeding telemetry from Google Cloud, Workspace, and managed browser profiles into Google SecOps. Utilizing Chrome Enterprise Premium enforced profile synchronization, capturing essential browser and security telemetry across unmanaged BYO staff hardware without requiring expensive infrastructure replacements.
Managed security partner StickmanCyber handles log tuning and rule customization and operates a 24/7 Security Operations Center (SOC) as the first line of defense across The Conversation’s environment. It also integrated non-native tools, such as password managers, and created custom log parsers for The Conversation’s in-house content management system (CMS) built on Google Cloud. With Google SecOps as its central security platform, the SOC investigates alerts generated across Workspace, Google Cloud, and its Chrome fleet. Crucially, the combination of Chrome Enterprise Premium and Google SecOps provides The Conversation with comprehensive visibility and telemetry across all devices accessing shared IT services. This directly mitigates the risks associated with unmanaged BYO hardware.
The majority of alerts are resolved by the StickmanCyber SOC without reaching The Conversation’s internal IT team. Alerts requiring organizational context or a business decision are escalated with details of what happened, who or what was involved, why the activity appeared suspicious, and recommended remediation. The SOC has triaged more than 7,674 security alerts, escalating less than 1% for investigation. Continuous detection tuning reduced monthly alert volume by 90%, while the SOC absorbed an estimated 700+ hours of triage effort in the last six months.
Critical events, such as unauthorized Google Cloud IAM permission changes, are delivered with context and remediation steps through Google Chat and email. To support deep investigations, the organization uses BigQuery for longer-term Workspace security log retention, extending data visibility beyond default 30-day limits to analyze historical patterns or potential data exfiltration. This foundation allows The Conversation to extend its security architecture to new editions in Germany and Switzerland without adding local technology headcount.
Google SecOps centralizes our security telemetry and enriches it, while StickmanCyber ensures we have expert eyes on alerts around the clock.
Knowing that monitoring doesn’t stop when I do means I can focus more of my attention on enabling the business and supporting staff.
Kim Bell
Director of Information Technology, The Conversation
The Conversation is a global non-profit media organization delivering independent news and research from academic experts to the public. Operating 13 regional editions across Australia, the US, the UK, Europe, Africa, and South America, it pairs academic authors with experienced journalists.
Industry: Media and Publishing
Location: Australia
Products: Google Security Operations, Google Workspace, Google Cloud, Chrome Enterprise Premium, BigQuery
About Google Cloud partner – StickmanCyber
StickmanCyber is an end-to-end cybersecurity managed services partner providing 24/7 SOC monitoring, threat hunting, log tuning, and incident response integration powered by Google SecOps.
