Defense Combatant Command drives efficiency to operate at mission speed

Key Challenges

Lack of visibility into major portions of the IT estate created concerns about the performance and security of critical applications and led to time consuming manual intervention in troubleshooting and analysis

Key Results

Identified and decommissioned under-used or overlapping functional applications while providing greater insights into the security posture and remaining applications performance and health.

Operating IT at Mission speed

The command faced significant challenges managing a portfolio of over 2,000 applications without clear visibility into usage, security, or health. This lack of insight drove inefficient software spending and hindered application rationalization efforts. Limited visibility into the broader IT estate led to resource decisions based on gut feelings rather than data. Meanwhile, slow, manual incident response processes introduced mission risk and fragmented accountability across IT teams resulted in prolonged and contentious troubleshooting.

Outcomes

Annual saving of over $1.5 million by reducing 40% of licensed applications
Reduced MTTR for applications performance issues and outages by 70%
Reduced unauthorized access incident response from 36 minutes to 6 seconds

Gaining visibility and control over operational and security blindspots

To regain control over their complex and distributed IT infrastructure, the command turned to Splunk. With over 2,000 applications and limited visibility into how they were being used, managed, or secured, the organization needed a solution that could provide clarity, drive efficiency, and support mission readiness.

By deploying distributed search across multiple sites, they were able to process data where it was generated. This reduced bandwidth strain at certain locations and led to a smoother, more productive experience for both users and IT personnel. Splunk’s native support for hybrid environments gave the team flexibility—supporting both cloud-native and edge processing—while also helping to reduce the administrative overhead associated with managing disparate systems.

As visibility improved across their entire IT estate, the command gained a deeper understanding of software usage and maintenance patterns. They were able to identify which applications were being actively used and which were not, allowing them to avoid unnecessary license renewals and redirect funding toward mission-critical needs.

Moved from gut feel decision-making to data-driven decisions

Beyond operational improvements, Splunk had a transformative impact on the command’s security posture. Mean Time to Recover (MTTR) and Mean Time to Investigate (MTTI) decreased dramatically. Troubleshooting became faster and less contentious, shifting from finger-pointing to collaboration, thanks to clear, data-backed insights. Security automation of unauthorized access incidents reduced manual recurring tasks for analysts, resulting in an average of $30k savings per analyst per year. For the first time, leaders could make confident decisions grounded in real-time operational data, rather than relying on assumptions or incomplete information.

With Splunk, the command not only improved operational efficiency and security—they gained the confidence to make strategic, data-driven decisions that directly support mission success.

Defense Combatant Command drives efficiency to operate at mission speed

Operating IT at Mission speed

Outcomes

Gaining visibility and control over operational and security blindspots

Moved from gut feel decision-making to data-driven decisions

Related Content

Leveraging Splunk for U.S. DoD IL5

How Splunk Supports the DoD’s Zero Trust Strategy