What PATH did
PATH is a global health nonprofit that, per Microsoft's account, works in more than 70 countries. Microsoft's page says its work reaches more than 150 million people a year. That work spans vaccines, treatments, medical devices, health-worker coordination, supply chains and outbreak response.
PATH worked with Microsoft partner BDO (listed as BDO Digital) to replace several disparate security tools with Defender XDR. The nonprofit also engaged a managed threat-response service, which the story calls Defender Experts for XDR.
According to Marvin Ngosa, PATH's Head of Global IT Infrastructure and Support, the old setup used separate tools for separate "lanes" of security. That made overlapping issues hard to track. He says the new platform puts endpoint detection, identity protection, email security and cloud app monitoring in one place.
The story does not give an endpoint count, a deployment timeline, a licensing mix or a product-by-product inventory. It also doesn't say which Microsoft 365 or Azure services PATH runs, beyond listing Microsoft 365, Azure and Teams among the products involved.
Why the cross-domain view matters
Ngosa gives an illustrative scenario. A phishing email leads to a compromised identity. That leads to endpoint concerns, then cloud app access, then possible data exposure. In his words, the platform helps PATH "connect those signals."
This is a hypothetical, not a reported breach. The story discloses no specific attack on PATH and no incident counts.
The scenario matches how Microsoft documents the product. Defender XDR pulls together several services: Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps. Microsoft's documentation says visibility, correlation and remediation improve as you deploy more supported services. A limited deployment doesn't switch Defender off, but it reduces visibility, and remediation only applies to entities covered by the services you've deployed.
Admins should read "one platform" as "one portal over whatever you've deployed." It doesn't mean every sensor is on by default. Microsoft's documentation also lists licensing requirements for the supported services. It says a Microsoft 365 E5, E5 Security, A5 or A5 Security license, or a valid combination of licenses, covers them. PATH's case doesn't say which licenses it holds.
Sensitive data and mission trust
PATH says it supports platforms that hold sensitive data. The story names personal details of clinical-trial participants and donors' credit card information. Peter Rizov, Global Head of IT and Transformation, says people expect their engagement with PATH to stay private. Aaron Schutzer, a senior transaction attorney, ties security to PATH's reputation with donors, local partners and ministries of health.
The story doesn't say which systems hold this data. It also doesn't name regulatory regimes or confirm that every such system sits inside the XDR deployment. Microsoft's description is that Defender XDR identifies attacks and isolates compromised assets, such as a hacked device or identity. The story offers no detection metrics.
PATH also uses Defender XDR's phishing simulations for staff worldwide. Ngosa says they help build an "always alert" mindset. There are no click rates, frequency or completion figures, so the story gives no evidence of reduced phishing success.
The money claim
The headline number is approximately $200,000 a year. Rizov attributes it to no longer licensing multiple tools from various vendors. He calls the consolidation a cost-cutting success amid financial pressures and funding reductions.
Treat that number with care:
- No baseline, calculation method or contract period is given.
- There is no net-cost breakdown. It doesn't say whether the Defender Experts service or BDO's fees are netted against the savings.
- PATH's setup and nonprofit pricing may not match yours.
PATH also reports less staff time spent on vendor relationships, contract reviews, access fine-tuning and keeping several platforms current. Rizov says the simpler environment needs fewer resources. No hours saved or staffing changes are quantified. The stated payoff is that IT staff can spend more time on proactive hardening, user experience, project support and acting on Defender XDR's recommendations.
Rizov calls Microsoft's nonprofit pricing transparent, fair and flexible, and says there is no uncertainty about unexpected rate changes. That is one customer's assessment. It is not a pricing guarantee, and the story gives no discount or renewal terms.
Managed detection: the small-team multiplier
PATH says it lacks the funding or capacity for in-house security and infrastructure experts at the depth these transitions need. BDO built the business case, led the deployment and placed the project within broader infrastructure modernization.
PATH also uses Microsoft's managed service, which the story describes this way:
- It triages investigations and gives proactive recommendations.
- It does proactive threat hunting and shares queries so PATH can run its own hunts.
- It responds to incidents. Communication runs over email and a 24/7 Teams channel.
- Monthly meetings cover attack trends and PATH's posture.
Ngosa says the service reduced "lead fatigue." His small team now prioritizes high-impact incidents and feels able to handle most incidents with experts behind them. These are qualitative claims, and no alert-volume or response-time figures are given. The story also doesn't say what plan PATH holds, what the contract terms are, or whether Microsoft can contain threats without PATH's approval.
A naming note for admins
The case study uses the older service name. Microsoft's current documentation calls the offering Defender Experts MDR. It says Plan 1 is the service previously offered as Defender Experts for XDR, and only the name changed. Microsoft's July 2026 security blog says everything available as Defender Experts for XDR carries forward unchanged as Plan 1.
Plan 2 is the new part. Per Microsoft's documentation, it extends the service to selected non-Microsoft telemetry collected in Microsoft Sentinel. It requires Sentinel and a minimum of 1,500 licensed seats. Microsoft says it is sold separately from other Defender products, so budget for it on its own line.
The documentation also lists what the service doesn't do. It is not an incident-response engagement for an active compromise. It also doesn't cover Defender for Cloud workloads such as storage, containers and databases. If PATH's contract includes those, the story doesn't say.
What to take from it
This is a vendor-written success story, so read it with that in mind. It makes no claim of independent verification, and it names no technical architecture or measured security outcome. Still, the pattern is realistic for lean IT teams:
- Consolidation can cut licensing and admin overhead. Fewer vendors means fewer contracts and fewer platforms to keep updated.
- Correlation is the real security benefit. Phishing-to-identity-to-endpoint chains are easier to follow in one incident view.
- Coverage depends on what you deploy. Check which Defender services are actually onboarded, and which licenses you hold.
- Managed detection extends a small team. It supplements a SOC rather than replacing it, and it needs its own budget and scope review.
- Check the trade-offs. Consolidating on one vendor concentrates risk and dependence. That is general industry reasoning, not something PATH's story discusses.
The most defensible conclusion is narrow. A resource-constrained global nonprofit says it simplified its security stack, cut licensing costs and added expert help. Whether the same works for you depends on your licensing, your deployment depth and your team's capacity.