Cortex Xpanse by Palo Alto Networks
Evaluate and Assess Security with Cortex Xpanse

The most significant breaches in the last decade occurred due to overlooked and vulnerable IT assets rather than phishing attacks, says Matt Kraning, CTO of Palo Alto Networks. This alarming trend is quickly rising with the increasing popularity of a remote work culture (where every employee’s home serves as a virtual branch office) and increased reliance on the cloud. And, making the problem worse, attackers can scan the entire internet at machine speed to find and exploit vulnerable, publicly exposed assets, whether organizations know about those assets or not.

In this environment, even cybersecurity experts need help in understanding what IT assets are publicly exposed on the internet as their attack surface changes continuously on-premises, in the cloud, and in subsidiary networks. If you’re relying on manual processes, it can be impossible to maintain constant visibility on multiple cloud vendors, third-party partners, security flaws that emerge during M&A, and any remote network employees may be on.

Cortex Xpanse assists security experts with their various needs in attack surface management (ASM), infrastructure governance, cloud security, compliance, and more, by providing the same continuous visibility into a company’s security gaps as attackers have, so security teams can remediate issues before they are exploited. With an outside-in view of everything clients own, Xpanse provides an accurate and continuously updated inventory of all global internet-facing assets, allowing clients to discover, evaluate and mitigate attack surface risks and exposures.

Palo Alto Networks’ Cortex product suite is engineered to provide enterprise-wide visibility, prevention, detection, and response, and automation capabilities. The enterprise’s acquisition of Expanse Inc. in 2020 augmented Cortex’s abilities to collect and attribute data on the internet and expose untracked vulnerabilities that might compromise an organization.

Initially seeded in 2012 by DARPA (Defense Advanced Research Projects Agency), the ‘mad science’ arm of the U.S. Department of Defense, the Xpanse team realized that protecting exposed critical infrastructure is only possible when organizations have a complete, current, and accurate view of all their digital assets.

“Our foundation and value lie in helping our partners discover and defend IT systems that they didn’t even know existed but are nevertheless vulnerable to attack by malicious actors over the internet,” says Matt Kraning, CTO of Cortex at Palo Alto Networks.

Xpanse continuously discovers and monitors clients’ digital attack surfaces across their networks to ensure that security operations teams have no exposed blind spots. Additionally, since the path of least resistance for attacks lies in unmanaged systems with outdated or nonexistent security, Xpanse assesses information such as device types, connections to other assets and owners, and possible vulnerabilities. The solution scans 4.3 billion IP addresses to uncover gaps before attackers discover them. This helps firms prioritize their cyber risks and determine whether their exposed assets should be taken down, patched, or monitored.

Our foundation and value lie in helping our partners discover and defend IT systems that they didn’t even know existed but are nevertheless vulnerable to attack by malicious actors over the internet

Palo Alto Networks’ interaction with a Fortune 100 healthcare provider is an excellent example of how the Xpanse solution bolsters IT infrastructure. The client had over 2,000 workstations, which they were unaware of, directly exposing vulnerable remote access services to the public internet. Using Xpanse to detect and remediate these systems, they not only reduced the number of such systems by over 95 percent in less than a month but also attributed all internet-connected assets and monitored them under a single roof.

With a wealth of ASM knowledge at its behest, Palo Alto Networks wields Cortex Xpanse to streamline cybersecurity processes and inspire trust. The Cortex team comprises interdisciplinary experts from elite institutions bringing in a vast knowledge base that extends beyond just cybersecurity. Their expertise in building large-scale algorithms, researching data science, and working in military intelligence provides clients with fresh perspectives when solving their challenges.