Vulcan Materials Consolidates Security Operations for the AI Era

Vulcan Materials plays a foundational role in the U.S. economy. As the nation’s largest producer of construction aggregates, its materials support everything from highways to data centers. Behind this physical footprint is a growing digital environment that must be protected across endpoints, identities, and cloud infrastructure.

With a security team responsible for approximately 9,000 endpoints and more than 550 plants, quarries, and shipping locations, Vulcan needed a way to keep pace with evolving threats at enterprise scale. By consolidating on the CrowdStrike Falcon® platform, the company accelerated security operations, improved visibility, and strengthened protection for critical systems running across the business.

When Harold Cole joined Vulcan as VP of Information Security and Privacy, he inherited a capable but fragmented security environment. The organization had already deployed CrowdStrike for endpoint security, but other parts of the stack operated separately. A legacy SIEM and an external managed security service provider lacked full visibility into the environment because critical telemetry wasn’t consistently integrated or shared.

Adding to the challenge, Vulcan’s security team was supporting a large and distributed operation. The team needed better visibility and faster response capabilities, but scaling headcount wasn’t realistic. Cole quickly concluded that simplification and consolidation had to become priorities.

Within six months, Vulcan expanded its use of the Falcon platform to include identity security, exposure management, cloud security, and SIEM. The company also added CrowdStrike Falcon® Complete for 24/7 managed detection and response.

“If I’m going to use their services, I want to use as much of the CrowdStrike stack as I can,” Cole said. “So we’re all playing from the same playbook.”

Falcon Complete now serves as an extension of the Vulcan security team by providing continuous monitoring, detection, and response.

“Not only do I consider Falcon Complete as an extension of our team, my CIO has said the same thing,” Cole said.

Vulcan worked closely with CrowdStrike through a collaborative onboarding process to define response playbooks that balanced automation with operational control. In some situations, Falcon Complete takes direct remediation actions. In others, the service alerts Vulcan’s internal team based on predefined parameters.

The value of that relationship became clear early in the deployment. “The most telling moment was the first time we got a Falcon Complete alert saying they had not only detected activity, but taken action to remediate,” Cole said.

By shifting continuous monitoring and frontline response responsibilities to Falcon Complete, Vulcan’s analysts can focus more attention on strategic priorities and higher-value investigations instead of routine alert triage. For a small team operating at enterprise scale, that operational support has become a major advantage.

As Vulcan expanded its use of Falcon Complete, the company also modernized the operational backbone of its SOC with CrowdStrike Falcon® Next-Gen SIEM.

Vulcan had previously relied on a legacy SIEM that required significant manual effort to maintain. Data ingestion, workflows, and rule management were handled by a small number of individuals, creating operational bottlenecks and slowing investigations.

“The legacy SIEM was powerful, but incredibly complex,” Cole noted.

By consolidating endpoint, identity, and cloud telemetry into Falcon Next-Gen SIEM, Vulcan simplified day-to-day operations and improved visibility across the environment. Analysts no longer needed to jump between disconnected dashboards and tools to investigate activity.

“The ability to consolidate all those feeds into a single pane of glass has allowed our team to move with greater pace and efficiency,” Cole said.

The transition also happened faster than expected. Cole initially believed the rollout would take six months or longer, but Vulcan reached full operational capability in roughly half that time.

“I fully expected it was going to be August before we were up to speed,” Cole said. “By May, we were up and running at what I considered full operational capability.”

With Falcon Next-Gen SIEM and Falcon Complete operating together on the same platform, Vulcan eliminated many of the visibility gaps and operational inefficiencies that had limited its previous security model.

As Vulcan continued to modernize its operations, cloud security became an essential capability to protect enterprise productivity. The company operates across a multi-cloud architecture.

To help stop cloud breaches, Vulcan uses CrowdStrike Falcon® Cloud Security, including cloud detection and response (CDR), to improve visibility and protection across its cloud footprint. This allows the security team to detect suspicious activity as it emerges and respond before threats can escalate into broader operational disruption.

By correlating cloud activity with endpoint and identity signals, Vulcan can better understand how threats move across domains and more effectively investigate incidents. For Cole, the goal is not simply reacting to cloud threats faster, but staying ahead of them.

“I feel like I can pace the problem and not be chasing the problem,” Cole said.

Cole sees AI becoming central to how security teams operate in the future. Attackers are already moving faster with AI, and he believes defenders will need the same advantage.

“The agentic SOC is not if but when … and how fast we get on board with it,” Cole said.

Today, Vulcan uses CrowdStrike® Charlotte AI™ to help analysts and leaders understand security activity more quickly. Instead of manually digging through technical details, teams can use natural language explanations to understand what happened and what actions were taken.

Looking ahead, Cole expects AI agents to play a much larger operational role by handling repetitive tasks and assisting with triage so analysts can stay focused on investigations and higher-level decision-making.

"The ability for AI agents to act as force multipliers allows us to stay proactive and resilient," Cole said.

Cole also believes recent developments in AI models are accelerating change across the cybersecurity industry. While the technology introduces new risks, he sees equal opportunity for defenders that can operationalize AI effectively.

“All technology is neutral,” Cole said. “It can be used for good, it can be used for bad, but it’s on us to understand how to use the technology and put it into play to our advantage.”

For Vulcan, the Falcon platform provides a foundation that can continue evolving alongside both the business and the threat landscape. By consolidating security operations and embracing the latest security innovations, Vulcan is building a scalable security program for the AI era.