Human middleware. Blind spots. Zero automation.
The college struggled with a siloed security architecture that forced analysts to manually bridge data gaps, leading to high risks and operational exhaustion.
- Critical blind spots: The legacy EDR solution lacked the granular depth needed to protect a diverse environment, creating substantial risk to student and faculty data.
- Fragmented tool sprawl: Analysts had to switch between four to five different dashboards, acting as “human middleware” and increasing incident dwell time.
- Open access vulnerabilities: As an educational institution, PCC must keep its network open for freedom of information, making broad-category threat blocking a hindrance to instruction.
- Manual operational bottlenecks: No cases were being closed by automation, leaving the team overwhelmed by high-volume, low-commodity alerts.
Path to platformization
Network security
Next-Generation Firewalls (NGFWs)
- Hardware Firewalls
- Software Firewalls
SOC transformation
Cortex XSIAM
Managed services
Unit 42 Managed Threat Hunting
Cloud-delivered security services
- Advanced URL Filtering
Advanced DNS Security
Saving time and money through a unified approach
Transforming SecOps with Cortex XSIAM
Going beyond EDR to revolutionize the SOC.
Building on a successful foundation of Palo Alto Networks hardware and software firewalls, Pima Community College initially sought a replacement for a legacy EDR solution that lacked sufficient depth. During the evaluation, CISO Lorenso Trevino remembers, “The Cortex XDR solution outperformed its competitors and was so compelling that we decided to go with not just the EDR solution but the platform play as well, incorporating XSIAM and Unit 42 Managed Threat Hunting.”
“We realized that with Palo Alto Networks, we could really have the best of both worlds with a point solution, best of breed, and the convenient experience of a platform solution.”
– Scott McGowan
Security Architect, Pima Community College
-
Scaling efficiency through unified automation
Transitioning to a single, unified AI-driven platform eliminated the need for analysts to manually stitch together stories from disparate tools. Further, the automatic grouping and deduping of alerts allows the team to maintain a near-100% case closure rate, even as daily data ingestion and data sources doubled. Cortex XSIAM also unlocked prebuilt playbooks and native integrations that had previously required costly, time-consuming custom development.
For Security Architect Scott McGowan, XSIAM has enabled a fundamental shift in philosophy, from reactive case management to an automation-first mindset. In addition to streamlining workflows, the platform has expanded the team’s visibility into alert categories it previously couldn’t afford to monitor, automatically resolving those streams at a rate of 80%. Looking ahead, PCC plans to use XSIAM as a bidirectional automation layer connecting other enterprise platforms, such as HR systems, that currently lack native automation capabilities.
![With Prior SIEM - With XSIAM]( "With Prior SIEM - With XSIAM")
-
Borderless network defense
The integration among Palo Alto Networks solutions has established a seamless intelligence layer that bridges the gap between PCC’s network and endpoint security. Its physical and network layers feed into Cortex XSIAM, where the data enters a unified analytics engine and is stitched together with data from hardware and software firewalls and Cortex agents into a single, comprehensive view. The security team can view network activity from a remote endpoint in the same pane of glass as on-campus traffic, while intelligence gathered at any endpoint immediately triggers an update to network policies across the entire campus. To secure its open network posture, PCC uses the Precision AI® capabilities of Cloud-Delivered Security Services, such as Advanced URL Filtering, to block threats based on behavior rather than broad categories, ensuring that instruction isn’t interrupted.
-
Expert augmentation in threat hunting
![Expert augmentation in threat hunting]( "Expert augmentation in threat hunting")
For elite, 24/7 oversight across its diverse environment, PCC relies on Unit 42 Managed Threat Hunting as an extension of its own SOC. This service integrates directly with the Cortex XSIAM platform, conducting autonomous threat hunts around the clock to provide PCC’s team with true peace of mind. Prioritization of risk through the assignment of alert criticality ensures that analysts aren’t bogged down by extra work; instead, they’re simply seeing things they would have missed otherwise. PCC also benefits from the expansive threat intelligence Unit 42 derives from customers across the globe and appreciates that it can use Unit 42 queries even when not impacted. Each hunt delivers an executive-ready impact report with validated findings and recommended actions. MTH services have saved each analyst 20 hours per week, allowing team members to shift from manual log searching to strategic improvements.
For elite, 24/7 oversight across its diverse environment, PCC relies on Unit 42 Managed Threat Hunting as an extension of its own SOC. This service integrates directly with the Cortex XSIAM platform, conducting autonomous threat hunts around the clock to provide PCC’s team with true peace of mind. Prioritization of risk through the assignment of alert criticality ensures that analysts aren’t bogged down by extra work; instead, they’re simply seeing things they would have missed otherwise. PCC also benefits from the expansive threat intelligence Unit 42 derives from customers across the globe and appreciates that it can use Unit 42 queries even when not impacted. Each hunt delivers an executive-ready impact report with validated findings and recommended actions. MTH services have saved each analyst 20 hours per week, allowing team members to shift from manual log searching to strategic improvements.“The impact reports provided by Unit 42 allow us to answer leadership’s question of, ‘Are we impacted?’ within minutes as opposed to hours.”
– Lorenso Trevino
CISO, Pima Community College
A long-term security roadmap.
Pima Community College views Palo Alto Networks not just as a vendor but as a long-term strategic partner. The partnership has moved the college beyond check-the-box compliance toward an elite security posture that provides measurable risk reduction. The result has been tangible, with PCC’s cyber insurance deductible now costing 60% less and its premium 20% less, all while doubling the coverage. As attackers increasingly leverage AI, PCC remains committed to scaling its defenses with AI-driven solutions to protect its community and ensure that the focus remains on student success.
“Through the partnership with Palo Alto Networks, I feel confident going into a board meeting and being able to demonstrate that we are providing our customers with a world-class security posture.”
– Lorenso Trevino
CISO, Pima Community College
share this story
