Claire Van HinsberghEngineering ManagerVodafone UK
Cyber engineering and CSOC. 3 to 5 billion security events a month. Telecom Security Act compliance.
n8n on YouTube (vendor case study), published Watch the webinar (opens n8n on YouTube (vendor case study) in a new tab)
Observation
Vodafone UK's cyber engineering team moved its security workflows to n8n and reports large time and cost savings.
- Takeaway
- Build reusable modules and a CI/CD path for workflows before the first security use case goes live, so each new workflow reuses tested pieces.
- What happened
- Vodafone's team handled 3 to 5 billion security events and thousands of alerts a month. The UK Telecom Security Act required logging and monitoring more assets, and its 2022 security regulations require that data to be held for at least 13 months. After trials of IBM Resilient and Tines, the team chose n8n for SOAR and general workflows, with code for complex integrations. It built reusable modules, including an email module, and used a CI/CD lifecycle with n8n environments and version control. One workflow checks critical feeds every five minutes and opens a ticket with the right team when a feed goes quiet. Since August 2024 the team has launched 33 workflows and reports 5,000 person-days and £2.2 million saved.
- Vendor case study (webinar published by n8n)
- Savings reported by the customer
- Partner Bounteous helped build
Deployment details
Cyber engineering and CSOC. 3 to 5 billion security events a month. Telecom Security Act compliance.
- Vendor case study (webinar published by n8n)
- Savings reported by the customer
- Partner Bounteous helped build
- Team
- Vodafone UK cyber engineering and CSOC
- Duration
- Since August 2024
- Workload
- Security monitoring, feed checks, triage, and fraud detection workflows
- Product version
- n8n with environments, version control, and reusable modules
- Measurement
- 33 workflows; 5,000 person-days and £2.2 million saved, about £300,000 a month in 2025
