Palo Alto Networks, Inc. (PANW) Earnings Call Transcript & Summary

Welcome to a New Paradigm for the Modern SOC. Hope you're ready for an inspiring discussion. Now security operations centers struggle to keep pace with an ever-evolving threat landscape and ever-increasing digital attack surface and the need to manage a multitude of security tools. On the other hand, we've seen the emergence of many interesting technology trends for the SOC like security analytics and generative AI, for instance. Today, we're going to take the chance to discuss with Forrester analyst, Allie Mellen, a few of these challenges of the modern SOC and the opportunities to revolutionize it. But let me introduce Palo Alto Networks SOC transformation philosophy first. Security operations centers of yesterday were pretty easy to operate, at least in comparison with a modern day equivalents, a trained security analyst had a few simple screens with a few simple sensors, and they could manually operate their SOC tools pretty easily. But today's SOCs are a remarkably complex combination of people, process, technology and data. The problem is today's SOC architectures have a security analyst at the center, and they are challenged with having to deal with all of these siloed tools and data. And there are so many point products, so many different consoles that they have to go and check, and data and insights are just scattered around. This hinders efficiency, generates frustration and weakens threat defense significantly. When an analyst has to handle an incident, they have to check all these different dashboards and try and piece all this information together in their head. There's a heavy reliance on manual work and manual workflows when analysts have to detect and respond to threats. And threats hide in the noise of data. In fact, on average, an enterprise generates more than 11,000 alerts per day, and a sizable fraction of them are completely ignored. They're not investigated because our heroic SOC analysts are overwhelmed with way too much manual work, way too many alerts. At Palo Alto Networks, we're solving this problem with Cortex XSIAM. Cortex XSIAM is driving unprecedented security outcomes for our customers. We are simplifying security operations with a converged platform, bringing together all of the security data and SecOps capabilities into a single product. We're able to stop threats at scale by using AI at the foundation of Cortex XSIAM, and we dramatically accelerate incident remediation by using an automation-first approach. Let me double-click on each of these in a little more detail. Firstly, what do we mean by a converged platform? Well, it's really 2 things. One, we're bringing together all the security data from across the enterprise. It doesn't matter if it's on the network, on the endpoints, in the cloud, whether it attacks surface management data or any other data source. We convert it all into the Cortex XSIAM data lake. We correlate it, we stitch it together. All the security data is in one place with Cortex XSIAM. Then we reduce operational complexity by converging all the tools that were once upon a time, separate point products and separate management consoles for that painstaking SOC analyst to have to deal with. We bring all of that together into a single management console with Cortex XSIAM. We have a customer, a Fortune 50 retailer, and they're seeing this advantage in real life with their XSIAM deployment. We've significantly expanded the visibility that the SOC analysts have with additional data compared to the old SOC platform, to that old theme. Now with Cortex XSIAM, they have 40 terabytes of data per day. They're seeing much more context all in one place with Cortex XSIAM. Next, what do we mean by stopping threats at scale with AI-driven outcomes? What XSIAM does is again bring together all of that data from across the enterprise. There are so many alerts from so many different systems, and these are low-quality signals that we bring together and stitch to give a unified view of the security incidents, turning those low-quality alerts into high-fidelity incidents. This enables security operation centers to accelerate threat analysis. Instead of having to try and find a needle in a haystack looking for threats in this enormous amount of data, we use AI and ML to bring it all together, to stitch it, to enable them to find threats much more easily. It also enables them to detect and respond to threats much more easily. Again, what were thousands of alerts end up being stitched and correlated into just a few incidents. And the AI and ML models over time get better and improve as they see threats as they learn more. And this protection is dynamic. It improves over time. And we have a large oil and gas company that's enjoying these benefits using XSIAM today. They went from having over 1,000 incidents per day being flagged from their SOC to having less than [ 150 ]. And they can finally clear through the backlog and ensure that all incidents are responded to across the enterprise. With Cortex XSIAM, we accelerate incident remediation by using an automation-first approach. This significantly reduces the manual effort that SOC analysts need to perform. So we bring alerts into XSIAM and we stitch them together into incidents, and then the automation engine automatically results, in many cases, the vast majority, leaving just a few for SOC analysts to manually investigate and respond to. This frees the SOC analysts up from triaging alerts and sifting through alerts to being able to spend more time on proactive security, like threat hunting and other sorts of activities that actually help improve the security posture of their organization. It also speeds up the investigation and response process. By using automation to either completely automate or partially automate most of the incident response process, we're able to reduce the MTTR pretty significantly. And the automation, it does get better over time. As SOC analysts perform manual workflows, XSIAM will ask them if they would like to turn those into automation so that next time the system can take care of it for them. And for this IT services customer, this has enabled them to dramatically speed up their incident response. Before XSIAM, the median time to resolution for their incidents was measured in days. And now with XSIAM, the MTTR is 15 minutes. So to bring it all together, Cortex XSIAM is the AI-driven security operations center's platform that brings together all the security data from across the enterprise: network, endpoint, identity, cloud, attack surface, it doesn't matter. We can ingest any data into XSIAM. XSIAM will stitch that together. It will normalize it. Then our AI, ML and automation engines will automatically resolve many of those incidents, leaving the SOC analysts and empowering the SOC analysts to do just the work that only humans can do, things that require reason and judgment. And finally, SOCs can clear through their entire backlog of incidents on any given day. We're seeing dramatic improvements in SOC metrics across our XSIAM deployments. With XSIAM, customers are ingesting more data but that's leading to fewer incidents. So we're taking in more data from more places across the enterprise. And normally in a typical SOC architecture, more data means more alerts, more false positives. That's not the case with XSIAM. Using our AI and ML and our data stitching technology, we're flagging fewer incidents, and the majority of which are completely automatically resolved, leading to -- with our XSIAM customers today, on average, 100% of their incidents being closed out compared to less than 20% with their legacy architectures. And the bottom line, XSIAM customers are now measuring their MTTR in minutes to hours versus weeks to months with their previous solution. At Palo Alto Networks, we believe it's time to transform the SOC. Cortex XSIAM will elevate your SOC teams to perform at their best. It will simplify security operations, it will stop threats at scale, and it will accelerate incident remediation. So this is a pretty big transformation. And we're certainly seeing a lot of customers completely transforming their SOC today with Cortex XSIAM. They're replacing their team, they're replacing their endpoint security, they're adding automation and attack surface management. But you don't have to do it all at once. You can start with Cortex XDR, replace your legacy endpoint security and start to bring in more data into XDR. You could start with XSOAR and begin to automate some of your manual SOC processes, or you could start with Xpanse where you can start to manage your attack surface and proactively shrink it. All of these are great first steps towards Cortex XSIAM, and we provide neat and easy upgrade parts where you can start today to solve your most immediate problem and then upgrade to XSIAM in the future when you're ready. For a quick run-through of all the exciting features and all the innovation coming up in XSIAM 2.0, you can check out the recording of our virtual launch event. And now let's welcome Forrester analyst, Allie Mellen, for an exciting chat about the future of the SOC. We're joined tonight by Forrester Principal Analyst, Allie Mellen. Allie, do you want to introduce yourself?

Yes. Thank you so much for having me. I'm, as you mentioned, Principal Analyst at Forrester. I cover Security Operations, so people, process, technology in the SOC. In addition to that, I also cover nation-state threats and AI and its use in security tools. Very happy to be here.

Allie, you contributed to defining the whole concept of security analytics. And in your work, I feel you highlighted that security analytics is basically seen an evolution spanning 2 decades. How did we transition from SIEM a whole bunch of solutions to end up -- land on security analytics. What have been the milestones in that transition?

Great question. Yes. So I've been with Forrester for almost 3 years now. And actually, we defined the term back in 2015, so before my time, thankfully. But it was my boss's responsibility to define it at the time. And what he was seeing ultimately was a big transition in the market from where we think of SIEM classically as log storage, taking a lot of that data into what's now security analytics platforms, which is really very focused around the detection and response use case, in addition to addressing some of those compliance requirements. And so what we see in security analytics platform that's so different is it has the basis in the SIEM or in data lake, and then it combines a series of other technologies on top of it to become more holistic and to really make it the center of the SOC. That includes user behavior analytics, store capabilities, threat intelligence platform capabilities, all brought together based on all of that data that's either being ingested or accessed so that you can do more interesting things with it and take response actions ultimately from the same platform.

So while defining security analytics in a way even back then in 2015, you saw beyond the SIEM, didn't you, you guys at Forrester?

Yes, absolutely. That was a key piece of this. I mean, the SIEM has been a fundamental part of security operations pretty much since its inception. It's been a very big part of this. But at the end of the day, because of that it's evolved a lot over time, right? We've seen it move from, hey, we're just going to throw a bunch of information in here into, okay, now we can expand beyond the traditional log formats that we saw which were originally very focused on the network into other areas. Now we can start doing analytics on top of that, start doing retrospective search. And into the platforms today, which have navigated from on-premise environments to now cloud native platforms, cloud-based platforms that are able to scale much more effectively than what we saw on premise. There's been a ton of changes in this market. And it's really interesting because I see a lot of teams that talk about legacy SIEM this, legacy SIEM that. But in reality, there's been so much changing and so much shifting in the market that, that transition to security analytics platforms makes a huge difference from where we were 10, 15, 20 years ago.

So what are your thoughts about the security analytics landscape in EMEA in particular?

Yes. In our data, we actually see that the European market is very focused on using security analytics platforms and SIEMs more so than any other tool in security operations. It really is the center of their operations when it comes to detection and response. And the main difference that we see or the main thing that stands out is just the importance of having the data hosted and accessed within the EU and making sure that, that is an opportunity for them, at least within the EU but sometimes within country as well. We see this in other countries and it's picked up quite a bit since, but the EU is really the one to [ lead ] that charge to. We need to make sure that even if we're using a cloud-native platform, the data is being hosted in our region or in our country.

But speaking of the outcomes that security analytics can generate, one of my favorite ones is threat hunting. And I'd like to focus on threat hunting now and on the fact that we at Palo have a philosophy of elevating an analyst capability so they can transition to a Level 1 Analyst type role, kind of a human gatekeeper in charge of triaging alerts and investigating incidents, to more of a threat hunter, a more sort of sophisticated kind of more all-encompassing role. So my question to you is, what are the key signals and the key capabilities that practitioners and SOC leaders should look for when selecting solutions that enable those advanced outcomes, that enable threat hunting?

That was a great question. Because at the end of the day, what every security operation center wants, that every SOC manager wants is to make sure that their team can up-level quickly, can have the skills that they need to make it to the next level and start taking on other tasks. One of the things that we talk about at Forrester is the importance of giving your analysts the time to focus, maybe like even 15% of their time ideally, on other things like you mentioned, like threat hunting. There's a lot on the process side that has to happen to make sure that, that can take place. But the biggest thing from a technology perspective that we see that buyers need to look at and focus on is how analyst experience is being enabled. We talk about analyst experience as a security analyst perception of the tools, processes, pretty much anything having to do with their role in the SOC and the ways that we can improve that. Technology is a huge part of that. And ultimately, it's about understanding the workflow that the analyst goes through and making it so that they can go through that workflow faster and more effectively. There's a lot that can be done from an investigative standpoint to make sure that we're not just delivering them an alert, but it's a contextualize alert. It is a combination of different alerts that have all the context that we need, maybe it's multiple stages of an attack. And if we know that they're going to need access to certain data or they're going to need to take a certain action as part of the investigator process, bringing that to the forefront so they have it immediately and can make that decision faster. That is what's going to ultimately give them more time to focus on additional things like threat hunting. And when it comes to threat hunting, what we really look for is how can analyst experience be applied to threat hunting. One of the things that we found and one of the values of the approach that we've taken to analyst experience is making sure that it can be applicable across multiple tasks that an analyst is going to work on. So not just, hey, investigation and response, how can we improve the analyst workflow? But also detection and engineering, how can we take a look at improving the way that an analyst goes about formulating an idea for a new detection and then implementing it. Or threat hunting, how can we improve things like the query interface and the way that they manage the threat hunts that they've developed so that they can do it more effectively and so that they can ultimately turn those queries into rules that then completes the threat hunting process. A lot of times with many implementations that we see, the extent of threat hunting features or capabilities is pretty much limited to, hey, here's a search bar. You have access to all the data, start using it. But there's a lot of features around providing some level of understanding of risk around each process or entity that can really help support the threat hunters mission and give them a little context clues for what might not be where they want it to be or what might indicate some potential malicious activity.

So you touched on analyst experience. The process of providing analysts with a unified interface to perform their tasks, I believe, started with XDR and now continues, as far as we're concerned at Palo Alto, with XSIAM, which is where we provide a unified interface for all the core workflows in the SOC from detection, investigation and response. So my question to you is, what do you think what defines good analyst experience?

In an ideal world, having one view where you could access and take action and investigate, would be ideal. We've been kind of searching for that for a long time. It's so challenging to find that but it's definitely ideally what we can get to. It's the kind of the vision for what we want to get to within the SOC. Now when it comes to analyst experience around that, ultimately, at the end of the day, we see that analysts have a lot of friction in their workflows and in their jobs in general, right? It's not just the thing that they see when they are using a particular platform. It's also the work that they have to do to even get to the point where they can use that platform, whether it's the integrations they're dealing with or the other products that they're dealing with that are in conjunction with that product, whether it's making sure the data is getting collected and input and transformed in a way that is going to make sense and help them achieve the outcomes that they want to. And so making all of these aspects of the analyst job easier or really making what I call the dependencies that the analyst has on using the products that they're trying to get value out of, simpler is fundamental to improving analyst experience. And letting them ultimately do what they're [ there ] for, what they're -- what they've really done all of their work in their careers to do, which is the security part of this job instead of a lot of the IT and tool management aspects that we've talked a lot about. The other factor here that is very important, and I want to make sure that I call out because I was very focused on the technology piece in the last question is, as I mentioned before, analyst experience goes way beyond just the technology that you're working in. It's also about how you, as the CISO, as the security leader, are making sure that your staff can get to the next level in their careers. They come down to things like thinking about how training is going to support them, thinking about what training is going to support them, thinking about their career path and their ability to get to the next level. When you take it from a holistic view and make this a key qualifier for success for your SOC, you will not only help your team be more efficient and effective, but you're also going to help retain that talent in the longer term and get them up leveled faster because at the end of the day, one of the biggest challenges, internal enterprises have, or internal SOCs within an enterprise have is that the people that they hire don't stick around for long enough. They stick around for a couple of years and then they're like, I'm off to work at a vendor and make a ton of money or I'm off to go work in tech and have better hours. And so anything that we can do to differentiate on analyst experience as a security operations function, that will help retain people. It will help keep them more interested in the field and it will help them get to the next level, which are all things that go on to support the business more effectively and support your team more effectively.

Okay. But analyst experience involves addressing the challenges faced by many practitioners, especially those that have to deal with tools that, I believe, in Forrester's words are, hard to learn and hard to master. Now my question is, could generative AI be a game changer in improving the analyst experience and shortening that learning curve for cyber analysts?

So I'll caveat this answer with if it's done the right way. The main thing that I'm seeing with a lot of applications of generative AI within security tools is that they're way more focused on things like the chatbot use case, which is flashy, it's novel, it's interesting. You get to talk to an AI. But at the end of the day, it's not built into the analyst workflow and into what they do every single day. There are some applications that I'm seeing of generative AI and security tools that are very tangibly focused on what the analyst is doing on how can we look at each part of the analyst workflow and makes sure that we're improving it. Things like handling reporting for them, building incident response reports based off of what happened during an incident. That's a really cool use case that can save hours of time for analysts. Another example that I find really interesting is [ query ] language conversion, being able to take human readable text or take queries that are in a different language and convert them into the language that you want. This is so helpful for practitioners because it enables them to spend more time focused on their security principles than necessarily on the product itself and how they need to use it and all of the different things they need to remember when it comes to the usage of the product. So I'm excited to see a lot of the applications of generative AI that we have the opportunity to build into security tools with the caveat that I want to make sure that they are impactful and that they really make a difference in the analyst workflow and what the analyst does on a day-to-day basis.

Awesome. In this new release of XSIAM, in XSIAM 2.0, we introduced copilot as a way to interact with the analysts, interact with the user and impact and improve that analyst experience. What are the benefits of copilots that you've observed? And will copilots transform security operations?