UAE Bank Migrates 12,000 Users to Prisma SASE
Zero downtime. 14 weeks.
How a UAE retail bank moved 12,000 employees from a legacy MPLS-backhauled VPN to Prisma Access SASE in 14 weeks, eliminating branch backhaul and improving Cortex XDR visibility under CBUAE cyber-resilience expectations.
UAE retail bank, 12,000 employees, multi-emirate footprint
Legacy VPN at 5x scale and CBUAE pressure
The bank had grown from 4,000 to 12,000 employees over four years through organic growth and acquisitions. Its remote-access VPN was a legacy IPSec deployment that backhauled all internet traffic through two data centers, then out through monitored egress. The architecture was designed for 4,000 users; at 12,000 it was an operational bottleneck. CBUAE cyber-resilience expectations had also tightened. The bank's SOC needed deeper visibility into endpoint and network telemetry than the legacy architecture provided. Branch traffic was particularly hard to monitor because everything routed through a single egress. Something had to give. The bank weighed three options.
Four reasons CWS won the engagement.
-
PCNSE-led delivery
Senior CWS engineer assigned as lead, reporting weekly to the bank's network architect and CISO. No tier-1 escalation gaps.
-
Bilingual change comms
End-user comms produced in EN and AR. Branch staff received Arabic-language guides for the GlobalProtect agent rollout.
-
CBUAE-aligned reporting
Engagement deliverables included CBUAE cyber-resilience mapping and audit artifacts ready for the bank's compliance team.
-
Cortex integration on day one
Prisma Access logs flowed into Cortex XDR from week one of pilot, giving the SOC visibility before scale rollout.
Five phases. Defined ownership.
- Phase 1
Discovery
Two weeks of architecture documentation, user-population analysis, and identity-source audit. Output: target architecture document and pilot scope.
- Phase 2
Pilot (500 users)
Two weeks of pilot rollout to a single business unit. Identity integration validated. Cortex XDR log-flow validated. Pilot success criteria signed off.
- Phase 3
Wave 1 expansion (3,000 users)
Three weeks rolling out to corporate-banking, treasury, and retail-banking divisions. End-user comms in EN/AR. Help-desk runbook activated.
- Phase 4
Wave 2 expansion (8,500 users)
Five weeks rolling out to remaining divisions and 80 branches. Branch IPSec connections to Prisma Access stood up in parallel. Direct-to-internet branch traffic enabled.
- Phase 5
Stabilization
Two weeks of tuning, MPLS de-provisioning, and handover to bank operations team plus CWS managed services contract.
What changed after the engagement.
- 12,000users migratedFrom legacy IPSec to GlobalProtect on Prisma Access
- 60%MPLS backhaul reducedBranch direct-to-internet eliminated 60 percent of traffic that previously routed through DC egress
- 0hours unplanned downtimeWave-by-wave rollout with rollback maintained service availability
- 14 weeksend to endFrom kickoff to MPLS de-provisioning
- Day 1Cortex XDR visibilityLogs flowed into Cortex XDR from pilot through scale, giving SOC continuous visibility
- CBUAEcyber-resilience mapping deliveredCompliance artifacts produced as engagement deliverable, accepted by bank compliance team
Where the engagement is heading.
The bank has expanded the engagement to cover Cortex XSIAM SOC modernization. Migration from the legacy SIEM is scheduled to complete within two quarters of the SASE rollout completing. The Prisma Cloud rollout for the bank's AWS workloads is in design.