Fluency SecurityASI Connect more than tripled its security operation in four months with Fluency and Claude
ASI Connect is a Johannesburg managed ICT provider with more than 30 years of enterprise experience and a 24/7 security operations centre. It is the Conekt Group (Conekt Holdings and SecureConekt), now majority-owned by the ASI investment group. It moved its SOC to Fluency in May 2026. Four months later, the security work it runs on Fluency has more than tripled. The difference is what clients now receive. Through Fluency's MCP connection to Claude, ASI Connect reports on more than incidents. It covers each client's whole security operation: hygiene, MITRE ATT&CK analysis and compliance documentation.
growth in ASI Connect's Fluency contract since May
from May 2026 migration to today
kinds of client reporting, beyond incidents alone
MCP connection from Fluency to Claude
"I pay all this money and get five emails a week"
South Africa is a hard market to defend. Daily Maverick counted six major South African organisations hit by cyber incidents in a single month of 2026. In Sophos's 2026 ransomware survey, 47% of South African victims said a complete lack of protection was the root cause, the highest of 17 countries. Only 40% recovered within a week, against 55% globally.
Boards now carry the accountability, and POPIA obligations sit on top. Clients need proof that their security is under control, not just alerts when it isn't.
Henry Denner runs security operations at ASI Connect. He set out the problem in Fluency's September 2026 webinar, How AI Changed the SOC. Every MSSP knows it:
- More clients meant more people. Going from a thousand endpoints to 10,000 meant hiring analysts to handle alerts. That added capacity but did not make the SOC more efficient.
- MDR is taking the budget. Henry puts MDR's growth into the SOC market at about 17% a year. MDR runs roughly $5 a device against about $20 for a SOC, and the output often looks the same.
- Clients can't see the value. Clients compare the SOC with a service desk and ask what they are paying for.
"I want that system to be able to give me actionable intel that I can take to my clients and say, here are the five key things you need to focus on."
Henry Denner, ASI Connect
ASI Connect's own Fluency site, run from Claude
ASI Connect runs a dedicated Fluency MSSP site of its own, with its client tenants behind the Conekt connector. The site gives Claude a governed MCP connection. Analysts sign in with their ASI Connect Microsoft account and approve, and Claude works with exactly their role and client scope.
Fluency does the heavy lifting before Claude reads anything. It moves from events to notable events, then to alerts, clusters and cases. Claude then works on scored cases with full context instead of millions of raw events.
Reporting on the whole security operation, not just incidents
ASI Connect's promise to the market is ISO 27001-certified security with audit-ready reporting that lets regulated clients prove operational control, not just describe it (IT-Online). Fluency and Claude are how its SOC produces that proof, client by client, every month.
Before, a client heard from the SOC when something went wrong. Now ASI Connect delivers regular, relevant reporting on how each client's security is actually run. Every report is built by Claude from that client's own Fluency data, through the MCP connection.
| Report | What the client learns |
|---|---|
| Incident investigation | What happened in a case, the evidence on both sides, a verdict with odds, and the next check |
| Security hygiene | Data-source health, configuration posture and what to fix first |
| MITRE ATT&CK analysis | Which attacker techniques the client's detections cover, and where the gaps are |
| Compliance documentation | Evidence gathered and mapped to the frameworks the client answers to |
| Monthly Managed-SOC report | All of the above in ASI Connect's brand: a Word report, a dashboard and Excel annexures |
This is the answer to Henry's "five emails a week" problem. Clients no longer ask what they are paying for, because every month shows them.
From alerts to answers clients can act on
- Onboard the team on their own identity. ASI Connect's site signs people in with Microsoft Entra across tenants. An ASI Connect security specialist was the first user onboarded end to end. Each analyst connects Claude once and gets only the clients assigned to them.
- Investigate cases, not alerts. Fluency groups related alerts into scored cases. An analyst hands a case to Claude, which gathers the evidence, checks the first triage and returns a verdict with reasons on both sides.
- Deliver the client report in ASI Connect's brand. A Claude skill builds a branded Managed-SOC report for a client tenant. The package is a Word report, a dashboard and Excel annexures, all drawn from that client's own data.
- Put a live console in front of the team. An ASI Connect security specialist is building a live Claude artifact that reads ASI Connect's Fluency site. It shows each viewer their own tickets and data health, using their own sign-in.
"How do we prevent the same things happening going forward? How do we deal with the risks?"
Henry Denner, ASI Connect
What changed for ASI Connect
"Clients do not buy technology. They buy the confidence that it will hold."
Trevane Paul, CEO, ASI Connect
ASI Connect moved to Fluency in May 2026. In four months, its Fluency contract has grown 3.3 times. That contract scales with the security work ASI Connect delivers for its clients, so its growth tracks the growth of ASI Connect's SOC business. Chris Jordan, Fluency's CEO, credits one change above all: ASI Connect now engages clients with relevant reporting on their whole security operation, produced through Claude.
| Before | With Fluency and Claude |
|---|---|
| Growth meant hiring more analysts to clear alerts | Analysts work scored cases. Claude collects the evidence and drafts the verdict. |
| Clients got a stream of alert emails | Clients get hygiene, MITRE ATT&CK and compliance reporting, branded as ASI Connect |
| Reports were built by hand for each client | A one-line request to Claude builds the report package for a client tenant |
| The value of the SOC was hard to show next to MDR | Health, posture and risk guidance, not just "what happened" |
| Adding a user meant setup by hand | Sign in with the company's Microsoft identity; scope is assigned per client |
Why an MSSP can trust Claude with client data
From detection to the CISO's team
ASI's investment gives ASI Connect the capital, national reach and Level 1 B-BBEE credentials to take this service to more enterprises. It will be sold as one accountable partner across infrastructure, cloud, connectivity, workplace support and cybersecurity. Governed, Claude-driven reporting scales with it: each new client gets the same hygiene, MITRE ATT&CK and compliance reporting from day one.
ASI Connect and Fluency are taking the story to the market together. Henry Denner and Chris Jordan co-presented the four-part webinar How AI Changed the SOC on 16 September 2026. They return on 14 October with Reimagining SOC Services. That session covers how AI lets providers go beyond detection to risk clarity, governance evidence and board-ready guidance.
See how Fluency and Claude can turn your SOC into an insight engine.