Jiangsu Kanion Pharmaceutical
AI-Powered Network Security Operations Upgrade Project
Client Introduction
Jiangsu Kanion Pharmaceutical is an A-share listed national key high-tech enterprise specializing in R&D, production and sales of traditional Chinese medicine, chemical and biological medicines. Boasting over 700 valid invention patents and leading R&D strength in China’s TCM sector, it operates a large scale of network and security devices with strict requirements for security incident analysis accuracy.
Pain Points
Before deploying SAI, customers from pharmaceutical, manufacturing and government sectors all faced common bottlenecks in traditional security operations, with specific pain points as follows: Overwhelming manual workload: Multiple security devices including Sangfor XDR generate hundreds of daily alerts, requiring time-consuming manual verification and creating huge O&M pressure. High false positive & false negative rates: Traditional platforms often misidentify normal business behavior as attacks while missing real malicious activities, leaving security risks undetected. Inefficient incident forensics: Manual incident analysis and evidence collection follow cumbersome workflows without intelligent support, resulting in low disposal efficiency. Fragmented O&M processes: Lack of a standardized security management system makes it difficult to conduct in-depth analysis and closed-loop management of massive alerts. Inconsistent judgment standards: Alert authenticity relies heavily on personnel experience, with no unified criteria to ensure stable and reliable operation results.
Products & Solutions
All three customers adopted Sinovatio Security AI (SAI) Full-Scenario Security Operations Solution to build an intelligent, unified security operation system. The solution centrally connects alert data from security devices across all branches and sites, and leverages LLM combined with multi-source threat intelligence to realize automated alert analysis, noise reduction and classification. It is embedded with dozens of AI agents for penetration testing, phishing simulation, high-risk port/service & weak password detection and more, to standardize and automate end-to-end security O&M workflows. For scenarios with massive alert volume such as government institutions, the solution can be deployed in combination with Sinovatio AISOC (AI Security Operations Center) for two-level processing: AISOC first performs initial aggregation, deduplication and filtering of massive alerts, before SAI conducts in-depth LLM-powered analysis and risk judgment.