Cintas Cut Containment Time From 2 Days to 3 Minutes with GreyMatter Agentic AI
Established in 1929, Cintas is a Fortune 500 company that provides workwear, business essentials, fire protection, and first aid & safety products and services to over a million customers across the U.S. and Canada.
Turning obstacles into outcomes
Challenges
180 billion security events monthly required manual triage across 10–15 disconnected tools
Critical alerts took one to two full days to investigate, with no confidence in completeness
Alert fatigue caused analysts chasing one critical alert while others went uninvestigated
Zero capacity for proactive security—the entire team was consumed by reactive firefighting
Results
Mean time to contain reduced to under 3 minutes—far exceeding their 10-minute goal
58+ automated response playbooks calibrated by severity, replacing manual scripting and tool-by-tool investigation
Ability to build and deploy new threat detections in 20 minutes
Team shifted from reactive alert triage to proactive threat hunting and detection engineering
Overview
Cintas’s security team is responsible for securing a sprawling security stack that protects nearly one million customers across multiple business lines. That team faces 180 billion security events every month. No team, regardless of its talent, can keep pace with that volume manually.
A Team of Ten Against 180 Billion Events
Before GreyMatter, every critical alert required Bowman's team to manually investigate across 10 to 15 different point technologies to fully rule out threat activity, taking one to two days per alert. With no single view to correlate findings, the team could never be certain that their response was correct or complete.
The volume of alerts compounded every problem. An analyst would lock in on one critical alert only to watch six more fire behind them, with no way to share context between parallel investigations. Events were inevitably skipped or missed, and every hour went to reacting to threats. Proactive work like threat hunting and detection engineering wasn’t just deprioritized—it simply couldn’t happen.
“AI is an accelerator in security operations—it's either against us or for us. The AI being weaponized against you is only getting faster, so you need to be faster to stop it."
Greg BowmanHead of Security & Engineering Operations, Cintas
AI That Operates Faster Than the Threat
Fifty-eight automated response playbooks calibrated by alert severity replaced the manual investigation process that once took days, dropping the mean time to contain to less than three minutes.
GreyMatter Workflows, a drag-and-drop automation builder within the platform, lets the team create, customize, and reuse operational processes without writing scripts.
"GreyMatter Workflows have revolutionized the way our team does work," Bowman said. With nearly 900 automated workflows executed in a single quarter, the team deploys new detections in 20 minutes. "The overall value of GreyMatter is much more than a point solution, SIEM, or SOAR."
That speed compounds over time. GreyMatter's agentic memories retain context from prior investigations—alert patterns, environmental baselines, past response decisions—to sharpen every automated response.
With the GreyMatter mobile app, Bowman’s team can run automations, execute playbooks, and launch threat hunts from anywhere. "One of the biggest things the team absolutely loves is being able to do everything with the app," Bowman said. "They can get a life back after hours."
"GreyMatter has helped us definitely shift from reactive to proactive. There is a lot more time being spent on proactive processes we never would have got to unless we went this route."
Greg BowmanHead of Security & Engineering Operations, Cintas
Learn How GreyMatter Agentic AI Scales Your Security Operations
GreyMatter is an agentic AI security operations platform with 6 agentic Teammates that use hundreds of agent skills and AI tools to work toward an objective, not just tasks.
