SAN FRANCISCO – Palo Alto Networks CTO and founder Nir Zuk expects more vendors will follow its lead to offer an autonomous security operation center (SOC) to replace legacy security information and event management (SIEM) and SOC tools.

For Palo Alto Networks’ SOC offerings, “all security operations are being run by machines and then we bring in the people,” Zuk said during his speech at RSA Conference 2022. “This is happening right now. We've isolated, we're building it, we're selling it.”

More often, security tools or teams figured out the issue only after a data breach has already happened, and the reason is “there's just so much information” to go through from different systems, data, and resources, he noted.

“That’s something that humans cannot do, there's too much information,” Zuk argues. “You can train all the people in the world to be cybersecurity experts … It has to be based on machines.”

In addition, the current approach in the industry has been to automate the SOC with the human in the center, he pointed out.

“The human is still driving and we can’t do that in the SOC if we want to investigate every data point coming in” to figure out what’s under attack, he said. So autonomous means bringing the people in later.

To address this issue, Palo Alto Networks recently rolled out an artificial intelligence (AI) based platform. Cortex XSIAM, which stands for extended security intelligence and automation management, will enable continuous vulnerability discovery through attack-surface management and threat intelligence gleaned from tens of thousands of Palo Alto Networks customers, according to the vendor.

In a video about XSIAM, Zuk compared the approach to car manufacturers adding adaptive cruise control and automatic braking. “We all know that this is never going to get to an autonomous car,” he said in the video. “If you want to build an autonomous car, you have to build from scratch.”

The same thing needs to happen in the security operations center, Zuk added. “XSIAM is the autonomous car of cybersecurity.”

He expects the industry will follow suit to adopt autonomous SOCs. “In a few years, you're going to see more than one vendor on the floor talking about this.”