Norlem claims “unfair advantage” for its SOC and clients from unified Cortex platform

While Norlem uses XSIAM to orchestrate its own security operations (and many of its client’s SOCs), the organizations it works with have widely varying infrastructure and security needs. For that reason, the firm also offers Cortex XDR and XSOAR.

• A step change in response. Before offering XDR to clients, most of Norlem’s endpoint detection was signature-based, with minimal AI capabilities. XDR introduced a sophisticated, multilayered defense model—and with it, a big boost in confidence. Previously, if there wasn’t known threat intelligence, Brillhart’s team had no confidence in its ability to stop an attack. With XDR, his team doesn’t have to operate on prior threat intelligence.
• Automation for everyone. For clients with mature existing processes, XSOAR captures those processes and automates where it makes sense. For more nascent SOCs, XSOAR allows every process to be documented. in a playbook, with automation added as comfort grows. Norlem has scaled its custom playbooks from fewer than 16 to approximately 300—even expanding beyond security to cover business use cases like onboarding new hires—which it provides to customers for long-term posture uplift.

Migrating from Prisma Cloud to Cortex Cloud solved a major operational friction point for Norlem: integrating cloud security into the SOC workflow. By moving cloud security closer to Cortex, the company’s SOC analysts—who operate entirely within Cortex—found it much easier to respond to cloud cases. Cortex Cloud provides:

• Visibility: It makes all public cloud activity visible and accessible, a challenge in cloud-native environments like AWS, where it’s difficult for novices to assess their footprint.
• Security and development alignment: It allows security analysts to speak more knowledgeably with developers, enabling them to address configuration issues without needing to be an expert in every public cloud service.

Beyond its visibility and ease of use, Norlem President Bryan Norman appreciates that Cortex Cloud tackles the broader challenge of cloud risk management—allowing the organization and its customers to meet regulatory compliance while delivering runtime visibility into traffic flows and threat actor activity. Rather than discovering vulnerabilities after deployment, “Cortex Cloud allows you to really understand how you’re consuming risk in real time, and then effectively mitigate that risk,” explains Norman. In an environment where new cloud services appear almost daily, this feature has proved essential to the business.