Shield against expanding threat landscape
Cyberattacks pose a significant threat to the uninterrupted delivery of essential public services, such as healthcare, social care, and education. In response to this ongoing risk, public service organisations need to streamline their security operations. However, the Council’s outdated security information and event management (SIEM) solution had integration gaps and was complex to manage.
As a result, its security teams were having to handle the majority of cases manually, delaying remediation and increasing operational risk significantly. Manual processes, however, are fundamentally incompatible with the fast-paced nature of modern threats – especially as attackers enhance their techniques.
The organisation’s specific SecOps challenges included:
- Responding to rising alert volumes despite limited budgets.
- Hiring and retaining qualified SecOps analysts.
- Preventing sophisticated ransomware and phishing attacks.
- Securing attack vectors expanding due to remote work and BYOD.
"Before Cortex XSIAM, it was difficult to fix the threats facing our public services. We were blind to many of the issues, and the delayed remediation threatened services and absorbed precious resources."
Grégory Refe
Head of IT Infrastructure, Conseil Départemental de la Vendée
Security journey
Network Security
PA-Series hardware firewalls
Endpoint Security
Cortex XDR
SOC Modernisation
Cortex XSIAM
Transforming SecOps from reactive to proactive
The Council had previously renewed its perimeter network security with PA-Series hardware firewalls, later adding Cortex XDR to provide extended detection and response across 9,000 endpoints. Based on this success, Cortex XSIAM was implemented to unify security functions such as XDR and SIEM into a single platform. Palo Alto Networks seamlessly stitches together network data from the Strata Network Security solution with endpoint activity from Cortex XDR to create the most complete, accurate security dataset. This fusion of visibility eliminates blind spots, empowering the Council’s security team to see the full attack narrative and automate complex detection.
“Cortex XSIAM was the missing link in our cybersecurity strategy,” says Richard Michalowicz, the council’s CISO. “It transforms security operations from reactive to proactive, so we can focus more resources on complex threats.
-
Transforms SecOps
The Council uses Cortex XSIAM through a managed SOC in partnership with Orange. The converged SOC capabilities – XDR, SOAR, and SIEM – simplify SecOps while also enabling new data sources to be onboarded quickly. So far, 20+ data sources have been added to the platform, streamlining investigations.
“Previously, the MTTD could be days – or never if we missed the threat. Now, we can detect issues in seconds,” says Richard.
-
AI-powered security accelerates response
The team has reduced the median time to resolution – from days, or even weeks, to minutes. For example, a vulnerable endpoint that might previously have gone unchecked over a weekend will now be isolated immediately.
Playbooks, triggered automatically, ensure tasks are executed even before an analyst is involved. “We’ve quickly built playbooks that coordinate multiple actions in a workflow. We now have the confidence that we are taking the correct action if a breach occurs,” says Grégory Refe, the Council’s Head of IT Infrastructure.
![]()
-
Saves time and resources
By automating manual efforts such as incident enrichment and threat analysis, the Council can redeploy resources to other, more strategic security tasks.
For example, the Council has gone from automating none of its case remediations to automating 80% of them – and that number is expected to rise as the platform matures.
“We are saving 50% of one analyst’s time – and for the first time, we’re monitoring our entire environment,” says Richard.
-
Safeguards council services delivery with platformization
Cortex XSIAM provides a unified view across network, identity, cloud, and endpoints, making it easier for the Council to confidently protect the public services and schools under its control.
“Our strategy is to stay compliant and be proactive. The single, integrated Palo Alto Networks platform simplifies our approach to security, liberating people to tasks that add value to the local community,” says Richard.
Speak with an expert today for a deep dive into our Cortex products and capabilities. Request demo
share this story
