Cisco claims its SecureX security platform adds over 1,000 customers each month and has been deployed across more than 4,000 organizations since becoming globally available at the end of June.

Also today at its annual partner summit, Cisco supplemented all of its security acronyms adding capabilities and integrations across its zero trust, extended detection and response (XDR), and secure access services edge (SASE) technologies. This includes adding a new orchestration layer on top of its security platform, SecureX.

“This means that there are now workflows that customers can use right out of the box, that automates not only the investigation, but also how to remediate,” explained Gee Rittenhouse, SVP and GM of Cisco’s Security Business Group. “So automatically you can start to isolate devices, or block URLs in the environment,” he added, describing it as “a best-practices response capability that we’ve added to the platform. That’s a significant step for us, because it really moves from just monitoring and detection into that response capability.”

Cisco started talking about SecureX at the RSA security conference in February and then made the platform available four months ago. SecureX integrates Cisco’s network, endpoint, cloud and application security products, as well as threat intelligence from Cisco Talos, in a cloud-native platform. The platform also connects to third-party security tools for investigations, and it provides XDR.

XDR aims to help security teams understand and detect threats by correlating threat intelligence across security products and providing visibility across networks, clouds, and endpoints. It does this by combining elements of security information and event management (SIEM), security orchestration, automation and response (SOAR), endpoint detection and response (EDR), and network traffic analysis (NTA) in a software-as-a-service (SaaS) platform to centralize security data and incident response.

It's an especially buzzy security operations technology-slash-acronym right now with well-established vendors including McAfee, Palo Alto Networks, and VMware as well as smaller startups all claiming XDR dominance. This is likely why Cisco touts SecureX as having “XDR capabilities and beyond.”

“XDR has been the holy grail, in many ways, of security for decades,” Rittenhouse said. But, he added, Cisco has a couple key differentiators. “The first is the breadth of our portfolio.”

Some companies claim to provide XDR, but they really just provide endpoint detection and response, or just network detection and response, Rittenhouse said. “Or maybe endpoints plus a firewall. But we have the breadth of our portfolio and it really is extended detection and response.”

Additionally, Cisco’s SecureX integrates with third-party SIEMs and other threat response products including Splunk and IBM Security QRadar SIEM, he added. “And we can start to automate those responses, making the platform even easier to use.”

Also at the Partner Summit, Cisco touted SecureX customer benefits and said the platform provided a 95% reduction in time to detect threats and an 85% reduction in time to remediate. Additionally, more than half of customers reported saving up to six hours per week on incident response.

University of North Carolina at Charlotte is one of these SecureX customers. The platform helped it simplify its security environment and reduced the time it takes for the security team to detect threats, said Jesse Beauman, assistant vice chancellor for enterprise infrastructure at UNCC. He leads security at the school and the CISO reports to him.

Since deploying the platform under Cisco’s early access program in March, UNCC has been integrating SecureX with its other Cisco security products including its Umbrella SASE platform, email security, and virtual private network (VPN) connections.

“We can tie all these systems together, and when we have an incident or something occurs, people don’t have to go to six or seven disparate systems,” Beauman said in an interview with SDxCentral. “They can go to one place, and they’re able to, in a very short period of time, determine what has happened, how big of an impact it is, and take corrective action. Before it could take days or weeks, and we can do it five or 10 minutes now with just a handful of clicks.”

SecureX also integrates with Umbrella, Cisco’s SASE platform, and Duo, its zero-trust security platform. And Cisco added updates to both of those products as well.

For Umbrella, Cisco launched a cloud firewall with layer seven capabilities. And it added a “trust monitor” to Duo, Rittenhouse said. This allows Duo to automatically detect suspicious logins with machine learning and alert security operations via API integrations with platforms such as SecureX.