So Drama! Entertainment Secures Creativity in the Age of AI

So Drama! Entertainment (SDE) is one of Singapore’s leading media and entertainment companies. Its 320 employees work across five established brands — Kakee, 88.3JIA, POWER 98, Music & Drama Company, and PIONEER — as well as talent management, creative services, video production, live performances, and campaign development.

This creates an unusually diverse technology environment. Beyond office laptops, SDE manages creative devices, shared systems, websites, cloud platforms, identity services, and third-party applications. But the company’s most pressing security challenge came from the same technology transforming its creative capabilities: generative AI.

AI rapidly became part of everyday work at SDE, particularly across marketing, research, and content creation. ~40% of the company’s image and video content is now AI-generated.

This adoption gave employees new ways to create faster and explore ideas. It also introduced a growing number of AI services into SDE’s working environment, including tools the technology team might not know were being used.

Every new service presented another potential route for confidential information to leave the organization. Sensitive information, including personal data such as Singapore National Registration Identity Card numbers, could inadvertently be entered into an unauthorized AI platform.

Blocking AI entirely was not a realistic answer. It would protect the organization by restricting the very tools helping its employees remain productive and competitive. SDE therefore faced a more fundamental challenge: How could it embrace AI at speed without exposing its data, employees, and reputation?

This was compounded by an existing operational burden. SDE was already using CrowdStrike endpoint security through a managed service, but its provider largely passed alerts back to SDE for investigation and resolution. The company’s small in-house security team was spending more than half its time investigating alerts.

“Our challenge is the variety of systems we need to protect and the lack of visibility we have across them,” said Kevin Neo, Head of Technology & Platform Solutions at SDE. “We not only look after office laptops; we also have creative devices, shared systems, websites, cloud platforms, identity services, and third-party applications. Security has to protect all of that without getting in the way of the work.”

SDE recognized that securing its infrastructure alone wouldn’t be enough. Protection had to extend across the endpoints employees used, the identities they worked through, and the AI services becoming part of their creative process.

More importantly, these signals had to be connected. An identity alert, for example, becomes more meaningful when viewed alongside activity taking place on an employee’s endpoint.

This led SDE to build its security model in three stages: strengthening endpoint response, adding identity context, and extending visibility into AI usage.

SDE first upgraded to CrowdStrike Falcon® Complete for 24/7 managed detection and response, supported by CrowdStrike partner Ensign InfoSecurity. Instead of simply forwarding alerts, CrowdStrike could investigate incidents, contain affected endpoints when necessary, and carry out remediation. This allowed SDE to move from an alert-focused model toward active detection and response.

“The biggest difference with Falcon Complete is the ability to move from detection to action,” said Neo. “When something is detected, the CrowdStrike team can investigate, contain the endpoint when necessary, and carry out remediation. We are no longer starting every investigation from scratch.”

CrowdStrike alerts were also integrated into Ensign’s managed security platform alongside telemetry from SDE’s broader infrastructure and cloud environment. This provided the team with greater visibility across its technology estate while reducing the burden of investigating every alert internally.

Identity security was the next stage. SDE was increasingly concerned about compromised accounts, data exfiltration, and the reputational consequences of an identity-based attack. By adding CrowdStrike Falcon® Next-Gen Identity Security to its Falcon Complete deployment, SDE gained greater visibility into human, non-human, and AI identities across its hybrid environment.

Identity risks could now be assessed in the context of endpoint activity and managed response. This gave the team more information before taking potentially disruptive action, such as disabling an employee’s account.

“The main advantage is the connection between endpoint, identity, and managed response,” said Neo. “An identity alert is more useful in the context of what is happening on the endpoint. That helps us make a more informed decision before taking a disruptive action such as disabling an account.”

With endpoint and identity protection established, SDE turned its attention to AI governance. The company needed to understand which AI services employees were using, identify shadow AI, and prevent confidential information from being shared with unauthorized platforms.

After evaluating three AI governance solutions, SDE selected CrowdStrike Falcon® Guardian to provide visibility and control over AI activity across managed devices.

“Falcon Guardian gives us a way to understand AI usage and build policy around sensitive prompts, unapproved tools, and AI-related risks,” said Neo. “That allows us to approach AI governance based on actual usage rather than assumptions.”

The ability to intervene is particularly important. If sensitive information is entered into an AI service, Falcon Guardian can block it before the information leaves the organization.

“The most powerful part is not just monitoring AI use,” said Neo. “If sensitive information is being passed through an AI tool, it can be blocked before anything happens.”

SDE is deploying the solution in phases, beginning with pilot users. The initial rollout allows the team to understand detections, inventory the AI tools being used, and fine-tune policies before wider implementation.

Over time, SDE plans to combine this visibility with application allowlisting based on its AI governance framework.

SDE’s approach reflects a broader change in the role of cybersecurity. The objective is no longer simply to defend systems after an alert appears. Security must give employees the confidence to adopt emerging technology without creating unacceptable risks for the organization.

Falcon Complete has reduced the burden on SDE’s security team by providing 24/7 managed detection and response, while integrating endpoint alerts with broader infrastructure and cloud telemetry has improved visibility across SDE’s technology environment.

The phased deployment of Falcon Guardian now gives SDE a foundation for understanding how AI is being used, developing practical guardrails, and preventing sensitive information from reaching unauthorized services.

“CrowdStrike has helped us move from an alert-focused model toward a more complete detection and response capability,” said Neo. “We have built on that foundation gradually, first with endpoints, then identity, and now AI security.”

As the number of AI tools continues to grow, SDE does not intend to stand in the way of innovation. Its ambition is to make innovation safer.

“There will be an ever-increasing number of AI tools moving forward,” Neo concluded. “We want to better protect our employees and the organization while allowing users to continue using AI without hindering their creative process.”