SiteMinder Strengthens its Data Protection with CrowdStrike

SiteMinder is the world’s leading hotel commerce platform, supporting more than 56,000 hotels across over 150 countries. Its platform connects hotels with 3,000+ technology partners to generate over 140 million reservations worth more than AU$85 billion annually.

That scale creates a significant responsibility to protect the data flowing across SiteMinder’s global environment.

As a cloud-native company running more than 100 applications, and with a mission to ‘turn potential into performance,’ SiteMinder gives employees flexibility to use the tools they need to do their best work. But as the number of applications expanded and employees began using more AI, the company needed greater visibility into how sensitive data was moving across endpoints, applications, and AI tools.

SiteMinder turned to CrowdStrike to build a more unified approach to protecting that data. The company started with endpoint security and has expanded across the CrowdStrike Falcon® platform to gain deeper visibility into user activity, applications, sensitive data, and AI.

“CrowdStrike enables us to be more effective as a security team because we can now see what’s happening,” Tuton said. 

Protecting data became increasingly complex as SiteMinder’s employees worked across a growing mix of applications.

SiteMinder deployed CrowdStrike Falcon® Data Security to gain visibility into sensitive data leaving corporate endpoints and enforce policies that prevent sensitive information from being uploaded to personal or unapproved services. This gave the security team greater control over how sensitive information moved outside approved workflows, while allowing employees to continue working with the tools they needed.

Endpoint visibility addressed only part of the challenge. With more than 100 applications across the business, SiteMinder also needed to understand how data was being shared and how applications were configured.

SiteMinder deployed CrowdStrike Falcon® Shield® to extend visibility and control into applications including Google Workspace, Okta, and Slack.

Falcon Shield helps the security team identify risky configurations, excessive sharing permissions, connected applications, and other potential security exposures. Internal files now have stricter access levels.

Falcon Shield also helps SiteMinder assess environments against internal policies and industry requirements such as PCI DSS. This additional context gives SiteMinder a clearer view of where risk exists so the team can address it earlier.

AI introduced another layer of complexity. SiteMinder encourages employees to use approved AI platforms to improve productivity. But the proliferation of AI apps, integrations, and agents created new pathways through which corporate data could move beyond approved systems.

“We encourage the adoption of AI where it helps our people work more efficiently. The challenge is the growing number of AI products and integrations connecting to different applications, platforms and data … all of which we need to protect,” Tuton said.

The challenge became particularly clear when employees wanted to connect personal AI applications to approved enterprise services.

“We were faced with the possibility that data could flow to or from a system into an AI platform that we didn’t know about,” Tuton explained.

SiteMinder added CrowdStrike Falcon® Guardian™ to extend visibility and control into AI activity. This helps the security team understand how AI tools and agents are being used and apply safeguards when sensitive or confidential information is exposed through AI interactions.

Together, Falcon Data Security, Falcon Shield, and Falcon Guardian give SiteMinder a more complete view of how data moves across endpoints, applications, and AI.

“CrowdStrike has made a massive difference to our data security,” Tuton said. “We have a lot more visibility over how our data is being managed, where and how it’s being used, and what users are doing with it.”

SiteMinder’s security team also leverages the agentic AI capabilities of CrowdStrike® Charlotte AI™ to introduce greater automation and triage the alerts received across the business. That has enabled SiteMinder to maintain the same security headcount, while significantly expanding the team’s scope and coverage.

Complex alert investigations that once took SiteMinder analysts hours can now take Charlotte AI minutes to analyse and provide a suggested root cause.

“The correlation the Falcon platform provides across users, devices, data, and applications is something we just didn’t have before,” Tuton said.

By bringing endpoint, data, SaaS, and AI security together on the unified Falcon platform, SiteMinder has gained broader visibility without requiring its security team to manage another collection of disconnected tools.

For Tuton, the value of that approach continues to grow as SiteMinder connects more of its environment to CrowdStrike.

“The more systems we connect into CrowdStrike, the better,” Tuton concluded.