1. Executive Summary

Coverage Scope

Implementation Approach and Timeline

Milestones: Commissioning before 1 Jun 2026. Full onboarding and operational before 31 Dec 2026.

What RWS Gets

Key Differentiators

Platform Differentiator

2. Company Profile and Credentials

Armor

Armor is a cloud-native managed security provider recognized by Frost & Sullivan as a leader in Managed Detection and Response. Our platform combines advanced threat detection, expert security analysts, and automated response capabilities to protect organizations across cloud, hybrid, and on-premises environments.

"Armor's MDR platform delivers unified visibility across cloud and on-premises environments with 24/7 expert monitoring and rapid response capabilities."

Lucas Ferreyra, Senior Industry Analyst - Frost & Sullivan

24/7 SOC Coverage

15 min Critical Response SLA

1,500+ Customers Protected

3 Global SOC Locations

Armor Certifications

Team Certifications

Better Together

3. Understanding of RWS Requirements

Based on the RFQ specifications and our discussions, we understand RWS seeks a comprehensive MXDR solution that addresses the following core requirements:

Interpretation of RWS Security and Operational Requirements

RWS's objective is to uplift cybersecurity operational resilience through an integrated EPP/EDR/XDR platform with 24x7x365 MXDR operations, delivered with a controlled migration from incumbent tooling and measurable operational outcomes.

Our implementation approach specifically addresses coexistence during transition, ensuring zero protection gaps during cutover and preserving operational continuity. The migration plan includes parallel operation periods, validation gates, and coordinated retirement of incumbent agents only after full Microsoft Defender XDR coverage is confirmed.

RWS Security & Operational Requirements

Key Challenges and Risk Areas Addressed by the Proposed Solution:

Assumptions & Dependencies

Assumptions

• June deadline achievable only if project awarded in January 2026
• Devices updated and all pre-requisites met before MDE onboarding
• Armor can provide dashboards, and reporting of SLO-style metrics under agreed volumes and conditions but does not warrant or commit to specific SLO thresholds. Only service SLAs (response/resolution/availability) are contractually binding.
• ORT/Commissioning and PGP completion will be based on functional correctness, defect exit criteria, documentation, and SLA process readiness; performance observations will be reported but not guaranteed as SLO commitments
• For XDR implementation, the platform shall be fully operational
• RWS will provide timely access to required systems, networks, documentation, and personnel
• Existing infrastructure meets Microsoft Defender XDR minimum system requirements
• RWS will complete ARB approval process prior to subscription activation
• Network connectivity between endpoints and Microsoft cloud services is available or can be established
• Existing security tools will remain operational during the transition period
• RWS IT team will be available for scheduled knowledge transfer sessions
• Change Advisory Board (CAB) will convene as needed for deployment approvals
• If travel outside Singapore is needed, additional per-diem cost will be charged and invoiced
• For MDE onboarding, device management tools like Intune will be used

Dependencies

• RWS Active Directory and Azure AD availability and access for identity integration
• SIEM and ITSM platform API access for bidirectional integration
• Endpoint deployment tool access (Intune, SCCM, or GPO)
• Network firewall rules permitting Microsoft Defender cloud connectivity
• Test environment availability for SIT and UAT activities

Prerequisites (RWS Responsibilities)

• Completion of security clearances for Armor Defense personnel requiring casino access
• Execution of NDA and data processing agreements
• Provision of current endpoint inventory and network documentation
• Establishment of communication channels (Teams tenant, email distribution lists)
• Identification of key stakeholders and project resources
• Current state documentation of existing EPP/EDR configurations for migration planning

RWS-Specific Threat Model

As an integrated resort handling millions of guest transactions annually, RWS presents a high-value target for sophisticated threat actors. Our detection and response strategy is specifically calibrated to address the unique threat landscape facing hospitality and gaming operations.

Key Threat Actors Targeting Hospitality & Gaming

Priority Attack Scenarios for RWS

Alignment with RWS Security Strategy

Resorts World Sentosa (RWS) is executing one of Asia's largest hospitality transformations with the RWS 2.0 expansion. New attractions, hotels, and digital experiences rolling out through 2030 will significantly expand the technology footprint requiring protection. This proposal leverages RWS's existing Microsoft investments, extends them with Armor Nexus for operational transparency, and provides managed XDR expertise to scale security alongside business growth.

Scaling Security with Business Growth

As RWS 2.0 brings new properties, attractions, and guest systems online, the security perimeter expands with each phase. Construction timelines and vendor access add complexity that traditional security teams struggle to absorb.

How this proposal helps:

• Microsoft Defender XDR provides unified visibility across endpoints, identity, email, and cloud from a platform RWS already uses, eliminating new tool adoption during critical expansion phases
• Armor Nexus delivers a single operational view as new systems come online, with AI-powered triage that scales detection capacity without proportional headcount growth
• Armor's managed service model absorbs the operational complexity of expanding environments, allowing RWS IT to focus on business-critical initiatives rather than security operations scaling

Protecting Digital Experience Investments

Guest-facing digital initiatives depend on infrastructure that must remain secure and available. High guest volumes mean any security incident affecting digital systems has immediate operational and reputational impact.

How this proposal helps:

• Microsoft Defender XDR correlates threats across the full Microsoft ecosystem, detecting attacks that span endpoints, identity, and cloud workloads before they impact guest-facing systems
• Proactive threat hunting identifies risks to guest-facing infrastructure before they become incidents, while pre-approved containment actions enable immediate response without waiting for change approval during an active threat
• Armor Nexus AI-augmented triage delivers 8x faster analysis, reducing mean time to containment for threats targeting operational systems

Governance and Regulatory Visibility

Singapore's regulatory environment requires demonstrable security governance with audit-ready documentation and clear accountability. Security operations must be transparent and defensible.

How this proposal helps:

• Armor Nexus transforms the traditional "black box" MDR model into a fully transparent partnership with real-time visibility into every detected threat, SOC action, and incident status
• Microsoft Defender XDR integration with Sentinel provides compliance-ready dashboards and immutable audit trails that satisfy regulatory scrutiny
• Structured reporting through weekly, monthly, and quarterly reviews creates the governance cadence regulators expect

4. Project Implementation and Onboarding Approach

Our phased implementation methodology ensures minimal disruption to RWS operations while accelerating time-to-value. Each phase builds upon the previous, with clear milestones and success criteria.

This unified implementation roadmap integrates project governance, platform deployment, and managed security services into a single coordinated framework. Rather than managing three separate workstreams with independent timelines and handoffs, RWS gains visibility into how each track progresses through common stage gates -ensuring that technical readiness, operational preparedness, and business outcomes remain aligned at every milestone.

The approach is deliberately structured around coexistence and controlled transition. Allowing the XDR platform to coexist with incumbent tooling during Stage 3 significantly reduces migration risk -detection coverage remains continuous, rollback paths stay available, and teams can validate behavior in production conditions before committing to cutover. MXDR services activate at the point of commissioning approval -not after full deployment -meaning RWS benefits from 24x7 threat monitoring from the earliest transitioned workloads through the complete and final cutover.

Implementation Timeline

The implementation follows a gated stage approach across three parallel workstreams. Project Management establishes governance, testing protocols, and deployment controls. The XDR Platform track handles technical deployment from tenant configuration through agent rollout and legacy retirement. The MXDR Service track activates threat monitoring capabilities progressively, beginning with use case planning and culminating in 24x7 managed detection and response.

Infrastructure as Code and Security as Code practices drive the platform deployment, enabling rapid provisioning with consistent, repeatable configurations at enterprise scale. Critical dependencies are sequenced to minimize risk: proof-of-concept validation precedes architecture commitment, commissioning approval gates service activation, and ring-based deployment allows controlled rollout with rollback capability at each stage.

Project Governance and Delivery Methodology

Governance Structure

Armor implements a structured governance framework aligned with RWS project standards:

Stakeholder Engagement and Reporting Cadence

• Daily Status Updates: During critical deployment windows and migration activities
• Weekly Progress Reports: Milestone tracking, risk/issue logs, upcoming activities
• Monthly Steering Reports: Executive dashboard, budget status, strategic decisions
• Ad-hoc Escalation: For critical risks requiring immediate executive attention

Risk Management Approach

• Risk Register: Maintained throughout project lifecycle with owner, probability, impact, and mitigation
• Weekly Risk Review: Assessment of new risks and mitigation progress
• Risk Escalation: Clear thresholds for escalation to Steering Committee
• Contingency Planning: Documented plans for high-impact risks including rollback scenarios

Quality Assurance Approach

• Acceptance Criteria: Defined for all deliverables aligned with RWS IT Project Delivery Framework
• Test Plans: Comprehensive SIT, UAT, ORT plans with requirement traceability matrix (RTM)
• Sign-off Gates: Formal approval required at each major milestone before proceeding

Platform Implementation Approach - Phased Adoption

High-level Service Transition Approach

Delivery Model | Implementation

The Implementation delivery model illustrates Armor and SWO's structured approach to deploying Microsoft Defender XDR for RWS. This framework is designed to ensure that desired security outcomes are achieved while keeping the implementation on track through disciplined stage-gate execution and continuous governance oversight.

At the top of the model, the Armor Platform & Security Team leads delivery through five sequential stages -each building upon the previous to systematically advance the deployment. Stage 1: Discovery & Validation confirms the current environment and validates requirements. Stage 2: Architecture & Planning establishes the technical blueprint and deployment strategy. Stage 3: Foundation & Coexistence implements core infrastructure while maintaining operational continuity with existing systems. Stage 4: Rollout & Cutover executes the phased deployment across RWS environments. Stage 5: Hardening & Full Operations optimizes configurations and transitions the platform to steady-state operations.

The successful completion of all five stages delivers the target outcome: a fully operational Microsoft Defender XDR platform providing comprehensive threat detection and response capabilities.

Underpinning the entire delivery is a robust Service Management & Governance framework. The RWS Project Team and Armor-SWO Project and Service Delivery Leadership collaborate through weekly operational meetings, monthly steering committee reviews, collaborative workshops, and continuous risk and issue tracking. This governance structure ensures alignment on priorities, rapid resolution of blockers, and executive visibility into progress -keeping the implementation on schedule and on target.

Delivery Model | Operations

The Operations delivery model illustrates how Armor provides ongoing managed detection and response services for RWS. This framework establishes clear operational touchpoints, defined responsibilities, and structured governance to ensure continuous security coverage while maintaining transparent communication between all parties.

The model operates across three integrated tiers. Technical Operations establishes the foundation where RWS ITSM integrates bidirectionally with Microsoft Defender XDR for incident ticketing and workflow automation. Armor's MDR experts -including Platform Engineers, Security Engineers, Detection Engineers, and Support Engineers -handle configuration, use case tuning, and ongoing support.

Security Operations delivers the core detection and response capability. Armor Nexus serves as the real-time MDR interface, providing AI-led enrichment, autonomous SecOps, service level tracking, executive reporting, and interactive incident management. Armor's Threat Responders and Threat Hunters work continuously to identify, investigate, and respond to security events.

Strategic Partnership ensures long-term alignment and value. Service Management & Governance provides structured touchpoints -Weekly/Monthly Service Reviews, Quarterly Executive Business Reviews, escalation management, and continuous improvement initiatives. Armor's Customer Success team, including Technical CSM, Account Executive, and Executive Sponsor, maintains strategic alignment with RWS objectives.

Armor Global Delivery Locations

Armor's global delivery model combines dedicated local presence with worldwide operational reach. Singapore serves as the primary delivery location for RWS, providing regional expertise, time zone alignment, and direct APAC coverage. This local presence is reinforced by strategically positioned global facilities that enable true 24/7 follow-the-sun operations, ensuring uninterrupted security coverage regardless of regional outages, capacity demands, or global threat events.

Armor Service Map

The diagram below illustrates how Armor's teams integrate with RWS's Microsoft Defender XDR environment through the Armor Nexus Platform.

Project Team

Successful security implementations require experienced professionals with clear ownership and defined accountability. Our team structure spans executive sponsorship through hands-on implementation, with escalation paths that ensure issues are resolved quickly at the appropriate level.

Armor Key Personnel - Implementation

Escalation Matrix - Phase 1

During implementation, the following escalation structure ensures that project risks, blockers, and decisions are addressed by the right stakeholders without delay.

Escalation Matrix - Phase 2 (Operations)

Once operational, Armor maintains two parallel escalation paths: one for security incidents requiring technical response, and one for service delivery matters requiring relationship management. This separation ensures security events receive immediate expert attention while service quality issues are addressed through appropriate governance channels.

Technical Escalation

Service Delivery Escalation

5. Proposed Solution

Our solution leverages RWS's existing Microsoft security investments while adding Armor's expert monitoring, threat intelligence, and response capabilities.

Architecture Overview

The diagram below illustrates how security telemetry flows from RWS data sources through Microsoft Defender XDR into Armor Nexus, where our MDR team provides 24/7 monitoring, investigation, and response. This architecture maximizes your existing Microsoft investments while adding Armor's expert human analysis and AI-powered threat detection -with full bidirectional integration to your ITSM for seamless incident management.

×

Solution Components

Microsoft Defender XDR

Your unified security platform that automatically correlates signals across endpoints, identities, email, and cloud to detect and disrupt multi-stage attacks in real-time.

Armor Nexus Platform

Nexus is Armor's unified security operations platform, providing unprecedented transparency into SOC activities, proactive threat defense, and intelligent support for complex global organizations. Launched in February 2025, Nexus delivers real-time visibility into every detected threat, SOC action, and asset status, transforming the traditional "black box" MDR model into a fully transparent security partnership.

Armor Dash: Unified Executive Visibility

Armor Dash is a revolutionary executive dashboard that solves one of the biggest challenges in enterprise security: managing multiple security vendors with fragmented visibility. For organizations like RWS that operate both SIEM/SOC services and XDR/MDR services, Armor Dash provides a single pane of glass that unifies all security telemetry, GRC platforms, and ITSM workflows into one AI-powered command center.

Armor MDR Team

Armor's Security Operations Center (SOC) combines human expertise with AI-powered capabilities to deliver enterprise-grade threat detection and response. Armor's Singapore-based team includes Security Engineers, Platform Engineers, Detection Engineers, Threat Responders, and Threat Hunters delivering specialized security operations with direct Asia-Pacific regional coverage. This dedicated local presence is backed by a globally distributed organization enabling true 24/7 follow-the-sun operational capabilities. With 15+ years protecting thousands of customers across 40+ countries and diverse industry verticals, Armor's team brings deep understanding of global threat trends and adversarial techniques to RWS's security operations. Comprehensive reporting keeps both technical teams and executive leadership informed through real-time dashboards, weekly operational summaries, and monthly executive reports.

Microsoft Security Copilot

Microsoft Security Copilot empowers RWS's internal IT and security staff to operate as effective co-management partners alongside Armor's expert SOC team. By transforming complex security data into natural language insights, Security Copilot bridges the communication gap between Armor's security specialists and RWS's operational staff, enabling more productive collaboration during incident response and strategic planning. Combined with Armor's Intelligence Platform (AIP), which delivers plain-language threat explanations and transparent decision rationale, RWS staff gain consistent, understandable context from both platforms. This enables RWS to understand Armor's recommendations, ask informed questions, and participate meaningfully in security decisions. With 35% productivity gains and the ability to answer security questions 44% more accurately, Security Copilot ensures RWS can fully leverage Armor's expertise while maintaining visibility into their security posture.

Proposed Trainings

To ensure RWS teams can effectively operate, maintain, and leverage the security platform, we propose the following role-based training program:

6. Managed Extended Detection and Response (MXDR)

Scope of Services

Armor delivers comprehensive MXDR services including:

• 24/7 Monitoring: Continuous security event monitoring and analysis
• Investigation: Expert-led threat investigation and correlation
• Response: Rapid containment and remediation actions
• Threat Hunting: Proactive searches for hidden threats

Operating Model

24x7x365 operations with Singapore-based L2/L3 analysts providing local expertise, supported by global follow-the-sun coverage for continuous protection.

Use Case Development Methodology

Our use case lifecycle ensures detection capabilities remain effective:

• Design: Threat modeling and use case definition based on RWS's environment
• Testing: Validation in staging environments
• Tuning: Optimization to reduce false positives
• Validation: Ongoing effectiveness verification

Coverage Areas

• Compliance monitoring and reporting
• Threat detection across endpoints, identity, email, and cloud
• Insider threat detection
• Continuous improvement through feedback loops

Service Levels and KPIs

Armor's service commitments are designed to ensure rapid threat containment and continuous security effectiveness. These contractual SLAs and measurable KPIs provide RWS with clear accountability, transparent performance tracking, and the confidence that security incidents will be addressed with the urgency they demand.

Response Time SLAs

Armor classifies all security events by severity and commits to defined response and update timelines for each level. These SLAs ensure that critical threats receive immediate attention while maintaining structured workflows for lower-priority events.

Key Performance Indicators

Beyond response times, Armor tracks operational KPIs that measure the overall effectiveness and reliability of our security operations.

Annual Support Hours

Armor Defense allocates 120 hours annually for additional service requests beyond standard MXDR operations, including:

• Architectural modifications and system enhancements
• Onboarding of custom log sources
• Security consultancy and advisory services
• Development of complex or customized use cases
• Firmware or software upgrade support

Unused hours may roll over to the next contract year, up to a maximum cumulative cap of 240 hours.

Alternative Professional Services

Alternatively, Armor provides RWS the option to utilise the hours for Professional Services:

1. Strategic Advisory: Development of long-term security strategies, roadmaps, and frameworks (e.g., NIST, ISO 27001)
2. Governance, Risk, and Compliance (GRC): Guidance and support for regulatory requirements and compliance frameworks
3. AI Security Services: Advisory and implementation support for securing AI-driven environments
4. Security Awareness Training: Programs designed to enhance organizational security culture and reduce human risk
5. Cybersecurity Tabletop Exercises: Simulated incident response scenarios to test and improve preparedness

The scope of these services will be mutually defined and agreed upon. Armor reserves the right to approve the proposed professional service or, alternatively, carry forward any unused hours.

7. Detection and Response Capabilities (Deep Dive)

Armor's detection and response methodology defines how threats are identified, investigated, and neutralized across RWS's environment. This section details the operational processes and technologies that enable rapid, effective response. Our layered approach combines Microsoft Defender XDR's native capabilities with Armor Nexus's AI-powered enrichment and 15+ years of threat intelligence, ensuring threats are identified across the full attack lifecycle and contained before causing business impact.

Incident Response Workflow

The following diagram illustrates the end-to-end incident response workflow, showing how alerts flow through investigation, containment, eradication, and recovery phases. Automation via Microsoft Sentinel SOAR accelerates response while maintaining appropriate human oversight for critical decisions.

Pre-Approved Response Actions

The following represents our minimum recommended pre-approved containment actions to enable rapid response. Armor maintains a library of additional response actions and can implement customized pre-approved actions tailored to RWS's operational requirements and risk tolerance.

8. Compliance with Tender Specifications

This section maps our solution to the specific requirements outlined in RWS-IT-RFQ-118.

9. Live Demonstration Readiness

Available Demo Topics

10. Appendices