Customer Case Study
Out of the Connector Business
How Halcyon used Synqly to compress a twelve-month integration build and accelerate its Microsoft Sentinel partnership.
“Without Synqly, I would not have been able to move the Microsoft partnership up our roadmap as aggressively as we did.”
Kris Lamb
Chief Product and Engineering Officer, Halcyon AI
Executive Summary
Halcyon embedded Synqly as its integration layer, skipped twelve months of foundational engineering, and went straight to a native Microsoft Sentinel integration.
Halcyon AI built the first dedicated ransomware resilience platform, and its growth created a familiar pressure for any security vendor at enterprise scale: customers run dynamic, multinational environments where tools come and go, and they expect new products to integrate into the stack they already use.
Meeting that expectation one connector at a time is a treadmill. Halcyon had already built and maintained roughly fifteen bespoke connectors, each with its own schema and API. Rather than stand up a full-time integration team to work a permanent backlog, Halcyon embedded Synqly. With the infrastructure absorbed, Halcyon skipped the foundation and went straight to the workflow.
The Challenge
Every Modern Stack Pulls You Toward More Integrations
Halcyon reached the integration problem the way most successful security companies do: by succeeding. Once the platform moved beyond its initial MVP and into commercial deployment, the nature of the modern security stack asserted itself. Enterprise and multinational buyers operate environments that are constantly in motion, and they need their tools to produce more value in combination than in isolation.
The economics did not improve at scale so much as relocate. Once the foundational work for a connector is done, iterating on that one connector becomes less expensive. What the math leaves out is the initial ramp for every integration and the maintenance that never ends.
At the time, Halcyon ran an engineering organization of 40 to 50 people and maintained a generic webhook that could push events to other products. It was a stopgap, not a strategy. The market offered no easy exit: the alternatives came with pricing that was hard to build a business on, or lock-in punitive enough to constrain flexibility. Halcyon built a good-enough connector here, chased an integration there, and repeated the pattern for just about every category of security product. That approach works until it does not.
“It is changing at clock cycles we have not really seen before. We needed a different strategy rather than going headlong into chasing connectors one by one.”
Kris Lamb
Chief Product and Engineering Officer, Halcyon AI
Finding Synqly
A Layer That Gave Halcyon Control of Its Own Destiny
Halcyon knew Synqly early. Many of the company’s founding engineers came out of Cylance, where Synqly co-founder Joel Bauman had worked alongside much of the same team, and the two companies share an investor in SYN Ventures.
Halcyon did not want another vendor to manage. It wanted optionality, control, and a layer that would keep working without a standing team behind it.
Synqly fit because it was built specifically for the security and IT ecosystem: one integration and normalization layer, a unified data schema aligned with the Open Cybersecurity Schema Framework (OCSF), and more than one way to deploy it. That last point mattered as much as the technology, because it meant Halcyon would not be trading one form of lock-in for another. When Halcyon began looking for a way off the connector treadmill, Synqly was already a known solution, not a net-new evaluation.
“Even at forty to sixty connectors, once you do the foundational work, iterating becomes less costly. But that is for just that one connector, and it does not account for the maintenance burden over time. The initial ramp, the plumbing and cross-cutting concerns for every single integration, adds up fast.”
Kris Lamb
Chief Product and Engineering Officer, Halcyon AI
The Microsoft Opportunity
Right Platform, Right Time
The decision to adopt Synqly coincided with one of the most important commercial opportunities facing the company. In the summer of 2025, Halcyon was opening its Microsoft conversation and weighing whether to build a dedicated Microsoft Sentinel integration entirely on its own platform. The timing made the choice concrete.
“When we looked at Synqly, it was around the same time we were kicking off the Microsoft conversation. It felt like the right tool at the right time, the right platform at the right time, to prove it out with Microsoft. And if that accelerated our partnership and opened the door to other security tools, all the better.”
Kris Lamb
Chief Product and Engineering Officer, Halcyon AI
The alternative was expensive in the one currency Halcyon could not spare: time. A native Sentinel integration built in-house would have required the team to construct the entire foundation before it could touch the parts customers actually experience.
“We were looking at least twelve months of development work across the team to get the foundation in place, iterate, build the workflows, validate, and test. By not having to do that foundational work, we could focus immediately on the specifics of the workflow and the native integration.”
Kris Lamb
Chief Product and Engineering Officer, Halcyon AI
The Synqly Solution
One Integration Layer, Three Advantages
Skip the Foundation, Build the Workflow
With Synqly handling connectivity, normalization, and cross-cutting infrastructure, Halcyon’s engineers spent their time on the workflow customers see. The Microsoft integration is bidirectional and real-time with Sentinel, mapped through OCSF and Microsoft’s ASIM.
A Two-Pronged Path Into Microsoft
Sentinel was the deliberate entry point. Establishing the native Sentinel workflow unlocked Halcyon’s ability to go deeper with Microsoft Defender, turning one integration into a route through the broader Microsoft security ecosystem.
Deployment Optionality for Regulated Customers
Synqly Mesh runs cloud-to-cloud and Synqly Embedded stands up inside Halcyon’s own infrastructure, in the regions a customer requires. Synqly also absorbed the overhead of not-for-resale licensing and its data handling.
The Result
A Partnership Moving Down the Tracks
Halcyon partnered with Synqly and began production work on the Microsoft integration in earnest. Progress has been fast and, in Lamb’s account, smooth. The Halcyon to Microsoft Sentinel integration is available in the Azure Marketplace, and early beta customers are turning it on.
Halcyon has been featured in a Microsoft blog covering the integration across two components of the Azure Sentinel ecosystem. Halcyon views the Synqly relationship as a scalable strategy rather than a one-time fix: the same layer that accelerated Microsoft will absorb the next integration, and the one after that.
“Implementation and deployment went very smoothly. Synqly was extremely responsive. It has been a strong partnership, and we are looking forward to launching more formally with Microsoft, which is moving down the tracks.”
Kris Lamb
Chief Product and Engineering Officer, Halcyon AI
At a Glance
Company
Category
Ransomware resilience
Customers
Enterprise and multinational organizations
Synqly Product
Want this case study as a PDF?
Download the Case Study About Halcyon
Halcyon AI built the first dedicated ransomware resilience platform. Its customers are enterprise and multinational organizations running environments that are constantly in motion, where tools come and go and new products are expected to fit the stack already in place.
Deployment Optionality
“What gives us peace of mind is that Synqly supports two integration models: Synqly Mesh, which is cloud-to-cloud, and the ability to stand up Synqly inside our own infrastructure. We have customers with heavy data sovereignty requirements that must operate in specific regions, and Synqly can operate in those regions too. We wanted that optionality.”
Kris Lamb
Chief Product and Engineering Officer, Halcyon AI
