Cybersecurity Threat Detection

AI scans security assets and events against threat intelligence and helps triage alerts in internal security operations.

Business impact

• Time to scan the security surface against threat-intelligence indicators — Adobe reported a reduction from three days to 15 minutes.
• Alerts fully automated end-to-end — Palo Alto Networks reported 15% of alerts as fully automated end-to-end.
• Alerts with partial automation and analyst input — Palo Alto Networks reported 85% of alerts with partial automation and analyst input.
• Security-relevant events analyzed per day — T-Systems reported up to 2.5 billion security-relevant events analyzed per day.
• Global data sources analyzed per day — T-Systems reported around 3,300 global data sources analyzed per day.

Data requirements

• Security event data (tabular) — Used for SOC analysis of security events.
• Threat-intelligence indicators (text) — Used as the matching reference for scans against new threats.
• Systems and asset inventories (tabular) — Used to scan the company’s surface area for exposure to new indicators.

AI methods and techniques

• Threat-intelligence correlation — Used to compare systems and assets with new indicators of compromise.
• Machine learning — Used in the SOC to analyze security data and identify threats.
• Alert automation — Used to automate some alert handling end to end and assist analysts on others.

Industries

Real-world evidence

3 documented case studies on record.

Companies using this: Adobe, Deutsche Telekom, Palo Alto Networks.