Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Over recent years, US critical infrastructure has become a primary target for coordinated cyber attacks. Small water, gas, and electric utilities have faced serious risk from cyber attacks while dealing with limited budgets, staff, and forensic expertise, leaving them further exposed. Advancements in AI have made the cyber threat landscape even more challenging. AI has become an enabler of cyber attacks, rather than a solitary perpetrator.

Same logs, two places, overlapping outcomes. It's time to rethink the SIEM vs. XDR question. In my last blog, I asked where XDR fits into the SIEM-less conversation. To answer that, start with the endpoint. If every threat could be stopped there, there would be less need for detection and response products such as endpoint detection and response (EDR). But attackers got better at evading even the most robust endpoint security, for example by abusing dual-use tools in living-off-the-land (LOTL) attacks.

With 96% of security teams now using AI, the question is no longer whether AI delivers real value to the SOC, but one of efficiency and reliability. The recent AI Adoption in the SOC report, conducted by Dimensional Research and sponsored by Elastic, surveyed more than 400 cybersecurity professionals responsible for security operations at companies with more than 500 employees.