How Cullinan Holdings Secures Customer Trust Across South Africa's Tourism Industry

Every year, millions of travelers visit South Africa to experience its wildlife, coastlines, vineyards, and cultural landmarks. Cullinan Holdings, one of the country's leading tourism groups, makes many of these journeys possible. 

Behind every trip is a complex operation spanning more than 20 businesses, 1,000 employees, and countless customer interactions. For Ryan Porter, CIO at Cullinan Holdings, keeping those experiences running securely depends on technology that is always available.

"Protecting personal information and making sure our platforms are available is crucial," Porter said. "If people can't book a flight, change a reservation, or access our services, it's not only revenue loss, it impacts people's lives."

As cyber threats evolved and the business continued to grow, Porter knew Cullinan's approach to security had to evolve as well. The company needed greater confidence in its security operations, better visibility across its environment, and a stronger foundation for the future.

Operating across South Africa presents unique cybersecurity challenges. Organizations must defend against sophisticated attacks while complying with the Protection of Personal Information Act, which governs how personal information is collected, stored, and protected. 

Cullinan's environment adds another layer of complexity. A centralized IT organization supports more than 20 businesses, each with different operational requirements but a shared responsibility to protect customer information. 

Before adopting CrowdStrike, Porter lacked confidence in the company's security environment. Multiple security tools created blind spots across the environment, and alerts often required significant investigation before the team knew whether they were real threats or false positives.

"We need to trust the information we're getting, but we couldn’t,” Porter said. "We were either chasing legitimate threats or chasing our tails."

In 2024, Cullinan adopted the AI-native CrowdStrike Falcon® platform, beginning with CrowdStrike Falcon® Insight XDR and CrowdStrike Falcon® Adversary OverWatch. During the proof of concept, the Falcon platform immediately uncovered policy deficiencies, outdated operating systems, and dormant malware that had gone undetected — exposing risks the previous platform had simply missed. The findings quickly validated Cullinan's decision to modernize its security strategy.

"We thought we had a best-of-breed solution," Porter said. "But the difference became very apparent once we started using the Falcon platform. It did exactly what it said it would do."

Within four weeks, Cullinan had deployed the Falcon platform across 1,000 endpoints and shifted its focus toward refining detections, strengthening policies, and closing security gaps.

By deploying the Falcon platform and 24/7 managed threat hunting, Cullinan significantly reduced the operational burden on its lean IT team. Security alerts dropped by 65%, allowing the team to spend less time validating noise and more time responding to genuine risk.

"We're now able to focus on every alert and treat it with the urgency it deserves because we trust those alerts," Porter said.

The impact extends well beyond the security team. Team members who wear multiple operational hats now spend less time chasing false positives and more time supporting strategic initiatives across the business.

"Our lean team can't work twenty-four hours a day,” Porter noted. “OverWatch gives us 24/7 threat hunting, allowing us to be far more proactive instead of reactive." 

He compares Cullinan's cybersecurity strategy to protecting a home. "You don't just put a lock on the front door," he said. "You think about the doors, the windows, the walls, the fence, and the alarm system."

That philosophy guided Cullinan's modernization journey. The company began by securing endpoints before expanding protections across networks, internet-facing systems, and the broader technology environment. By strengthening each layer of its defenses, Cullinan built a more resilient security foundation without adding unnecessary complexity.

As Cullinan continues modernizing its technology environment, interoperability has become a key priority. Porter is committed to ensuring the technologies protecting the business work seamlessly together across its shared services environment.

The Falcon platform plays an important role in that strategy by integrating with the technologies and specialist partners Cullinan already relies on to create a more unified view of risk across the organization.

"No single tool is ever going to catch everything," Porter said. "Our goal is to make sure our tools work together so that what one doesn't catch, another one does."

For a lean IT organization supporting more than 20 businesses, that connected approach provides the visibility, operational efficiency, and confidence needed to protect the business and the travelers who depend on it.

"CrowdStrike wasn't just the right choice for Cullinan," Porter concluded. "It was the only choice. We couldn't find anything that could compete. Once we started using the Falcon platform, we realized just how much we'd gained in securing our environment, reducing noise, and making sense of the alerts we were receiving."