Stefan Schinkel: Tomorrow's SOC, Enabled Today with AI-Powered Detection, Prevention and Automation

So my name is Stephan shingle, running the cortex region, running cortex in the death region. For those of you who are not familiar with cortex, you will see the explanation at the end of this presentation. Yeah. So would we think that 2021 will become the automation approach? The year of automation because, and we heard this from some of the speakers as well. Automation is definitely key to be successful.

And some, some quote you can see right now we are undergoing a profound digital transformation and you see this everywhere. So the, the way communication is going to happen, fundamentally changes the way enterprises operate innovation connection with people, not only with customers completely changes.

And based on that, based on that transformation, we see that this transformation creates risk as well, because what we have here, there are some, some Richard, some researchers, one of 'em is Gartner saying by 2023, the average CIO will produce responsible for more than three times the endpoint they manage as in 2018. I mean, just imagine this three times the endpoints, on the other hand, the cloud deployment, what you have, applications are moving even faster into cloud and security can't cope up. It's very hard for them.

And another interesting statistics that 43% of all organizations facing, that's the biggest challenge to maintain security, consistency across data centers and public clouds. A lot of challenges here. And finally, unfortunately not only us, all vendors are using AI and machine learning components, the cyber criminals doing this as well. So here they're using this, that means threats are getting way more complex. They are evolving and we are seeing 67% of increase in cyber tech over the last five years. That is the risk that transformation creates.

So what we say is today's security challenges, significant, and some questions you should ask yourself. I mean, how do you deliver really this content? How do you deliver coordinated defense with consistent view, being compliant, have all this orchestration in place. You have a lot of set of point products. These which etching adding complexity, which adding costs. Another big topic is definitely that protecting a growing set of data across our networks, our digital networks, you don't want to slow down your development.

You don't wanna slow down your applications because you have to innovate. You want to drive growth. And at the end of the day, as mentioned this slide before you want to stay ahead of the increasingly complex and organized side of criminals of these bad guys, which are out there while you are facing 10,000 of security alerts daily, I have seen numbers will be saying 170,000 alerts per week. Just remember this 170,000 all onto your enterprise and what we think from Palo to, from cortex to feel confident. You definitely need as leaders, you need visibility.

You need visibility to see everything which is in your environment. I mean, to maintain control across all these complex security architectures there, unfortunately there's no green field. So there's legacy and research from ISG global, as well as seeing that 40% of our security professionals think this is they want to improve the way, the ability to discover, to prioritize remediate, self abilities, another topic.

And it's quite interesting when I was participating in a round table a couple of weeks ago, where we had an interview with the CIO from one of the largest retailers in Germany, he said his biggest challenge is human error. You know, everybody knows the same, the biggest error or the biggest, yeah. The biggest issue sits in front of the keyboard. And this is still the case. Yeah. And based off that, that he thinks he wants to automate whatever is possible because as you see here, 95% of cloud breaches occur due to human error, human error, configuration mistakes. Yeah.

And finally, what you need as leaders come simplicity and flexibility. Yeah. To operate safely because of legacy.

I mean, 55% of organizations have more than 25 security products deployed today. 25 products simply of legacy for different vectors.

So how, how can you deal with that? How can you manage that? So some thoughts on that, we think that point solutions are not enough best and breed solutions are definitely not enough. They do not scale point solutions. They do not communicate with each other data and different formats. They can't deliver you the 360 degree angle. I think it was Thomas Chas from telecom talking about ZM. Talk about the massive datas. It's not about having all datas. It's about good data. It's about the right data.

So better security decisions come from having the right data, not a sheer amount of data, so visibility and the ability to act on what you see that is absolutely key cloud cloud is definitely what we think a chance to make everything better. Security needs to be the enabler, not to stop work sucks, need to have the ability to automate cloud seamlessly for the users. That's the key should be seamlessly. And as mentioned, humans will always be humans. That's us. Yeah. I mentioned the fact that the biggest challenge sits in front of the keyboard.

Another aspect, I think that was touched on one, the presentations as well is we have limited talents. We have limited resources to reduce.

Yeah, that's what we have right now. And based on that, it's key that you automate automation is absolutely vital for that because we do not get enough people in the socks. We do not have enough Analyst based on that. The only chance is really automation and maybe an interesting side note for you. We as being Palo Alto, certainly for sure.

I mean, we have a large sock and based on the fact that we are eating our own, our own breakfast, we were able to run a highly automated sock, which is simply manned only our during business hours. That means we have only a day shift, no night shifts based just on our technology. And this absolutely helps based on the fact that there's simply limited time resources additional, well, the best defense against AI cybercrime is AI itself. So we think that if the, the vet guys, as you using AI and machine learning, you should use this as well.

And in the a day we heard in the beginning, some parameters about that, meantime to react mean time to response detection, time way too long. So investigation and resolution of threats takes days, maybe month, half a year. And that's absolutely too long. So it's absolutely key to do something on that. Hasn't as said 20, 21 security dynamics, the year of automation. So what do we do?

So cortex, we provide an integrated set up product, which is driven by good data, deep analytics and, and automation. Some numbers you can see here, fast incident investigation, eight times reduction of alerts, lower costs and reduction in weekly alerts, alert volumes requiring human revenue, because that is what it is. Most of the alerts that you're having right now is 170,000 per week is routine.

Why not automating this routine and to make sure that your analysts are digging into the high complex alerts and not into routine things, simply just to give you an increased efficiency for security teams and reduce risk of all breaches. That's the idea. And that's the attention. So challenge the solution, challenge yourself, ask yourself what can be automated. Automation is not longer just security. Think about what's the art of the possible and think about your assets, your people. How do you want to utilize your people? I think that is absolutely key. Think about that.

Think about the pressure that your people are facing. Think about how long your Analyst are working with you. Is it just two years? Is it four years? It is five years. Statistics are saying that the average Analyst is within companies for maybe two years or so. So because they're simply overwhelmed with work. So take work from their shoulders, challenge the solution. So what you can see here, some use cases that we think can be automated. It's definitely a good example, how we do this.

So impossible leveler cloud container, configuration, lost laptops, that's all routine simple use cases, which you can definitely automate. We're not talking about high, sophisticated stuff. This is simply use cases that appear on a daily basis. Why not automating this, think about that and the solution to the challenge. And this is where car comes in play. That is what we are talking about. Cortex at the end of the day, cortex is solution. And can we say a kind of platform, a platform for security, a platform at the end of the day for security operations.

So think about cortex as your one stop shop for seconds. One stop shop solving, definitely all key, all key challenges in a more efficient way with higher security outcomes. So this platform that we are providing has two primary elements on the left side, you can see cortex XDR simply for detection and response. So X stands always for the extension extension XDR in response.

So cortex XDR, especially with the X was the first to market and defining product and the XDR market category, which leap frogs EDR, which is narrow focus on just the endpoint on the right hand side, you see a solution would nowadays called so extended security orchestration administration, formally called DEO. We have acquired this company DEO simply for security operations, for automation and response. So customers, what we see lovely DEO because we have integrations with 300 plus vendors, which definitely helps solve any security use case. So that is what the cortex platform was all about.

Part of part of networks. And this is definitely the platform for security, operations, highly automated approach. So with that part of our networks better together, any questions, please be free to ask and thank you for listening.