Recent Developments + RSAC 2025 Recap

• Google is becoming a major force in the security space as the company unveiled its vision for "Agentic AI" in security operations. Unlike assistive AI, which supports human actions, agentic AI can autonomously identify, reason through, and execute tasks while keeping analysts informed.

  Google Cloud introduced an open protocol called Agent2Agent (A2A) in April while embracing the Model Context Protocol (MCP), an open standard to simplify how AI connects with security tools like SIEM, SOAR, and threat intelligence platforms. A2A and MCP are set to solve different but complementary challenges in agentic systems.

  With MCP server implementations already available across Google’s security products, it is a big step toward a more open, interoperable security ecosystem. Here’s an overview of Google’s MCP Server and partnership announcements with Cloudflare, CrowdStrike, Okta, and Wiz.

• SentinelOne unveiled Purple AI Athena, its new threat hunting and response agent, at RSAC 2025. SentinelOne’s Purple AI Athena release showcases an agentic AI framework that empowers autonomous threat detection and response. The integration of an MCP server allows these agents to communicate smoothly with other security tools, supporting a more connected and efficient security environment. It proactively investigates threats across various data sources, makes decisions, and executes multi-step responses without constant manual intervention. This marks an evolution from AI assistance to more autonomous operation, aiming to accelerate threat triage, investigation, and remediation dramatically.
  

• At RSAC 2025, identity security was highlighted as a crucial touchpoint for modern cybersecurity, especially as traditional perimeters fade.Proofpoint and CrowdStrike emphasized the need for platforms that manage identity across email, endpoints, web, and cloud, with CrowdStrike Falcon Privileged Access protecting against identity-based attacks. The rise of AI agents and non-human identities (NHIs) has made traditional security methods (like MFA) insufficient, prompting a shift toward token-based authentication and fine-grained authorization.
  
  Investments in identity security are clearly growing, with companies like Persona, Push Security, and Veza receiving significant funding to enhance identity management solutions. Overall, robust identity management integration is essential to secure both human and non-human access points in today’s complex, decentralized environments.

  
  

• Open Cybersecurity Schema Framework (OCSF) 1.5.0 was released on April 28, just days before RSAC, bringing a host of enhancements. Among the highlights are two new event classes, which we’ll explore further in the product update section. This release continues to strengthen the framework’s ability to standardize and streamline security data.

  
  

• Orca Security’s acquisition of Opus adds agentic AI-driven remediation to its CNAPP, enhancing Continuous Threat Exposure Management (CTEM) capabilities. The platform now autonomously identifies and prioritizes cloud exposures, like misconfigurations, vulnerable assets, and IAM risks, using contextual cloud graphs. Agentic AI enables policy-aware, real-time mitigation without manual playbooks, aligning with CTEM goals of continuous validation, reduced risk windows, and scalable response across multi-cloud environments.

Other Key Developments:

• Solid integration Roadmap: CyberArk's Identity Security Intelligence Platform introduced 37 new integration points featuring bi-directional data flow. As Forrester's Allie Mellen aptly noted, "We're seeing a shift from performative integrations to actual collaborative defense," an essential foundation for more autonomous security operations.

• OT/IT Convergence: The Forescout-NVIDIA partnership demonstrated significant progress in OT/IT convergence. This collaboration leverages GPU acceleration to scale OT network monitoring by an impressive 4x while simultaneously reducing overhead. Conference demos featured real-time analysis of PLC traffic, a capability that would overwhelm traditional tools, underscoring AI's power in specialized and demanding environments.

• Runtime Application Security: The Runtime Application Security (RASP) domain saw trends of consolidation and capability expansion. F5's acquisition of Cequence Security signals this market movement, while Datadog's Application Security Monitoring further extends observability directly into security functions.

• Zero Trust Implementation: Zscaler's Zero Trust Edge 2.0 introduces "identity-aware microsegmentation" for workloads. Complementing this, Cisco's Duo PassKey Enterprise is broadening FIDO2 passkey support to encompass legacy applications through innovative proxy integration, thereby strengthening identity-centric security postures.

Under the Lens — Google Security Portfolio

Google is steadily shaping up to be a strong major player in the security space. The company delivers enterprise-grade security through its integrated Google SecOps platform for scalable threat detection and response, powered by Mandiant intelligence. BeyondCorp Enterprise enforces zero-trust access, while Security Command Center secures GCP assets. VirusTotal aids in global malware analysis, and reCAPTCHA Enterprise protects against bots. Together, these tools offer end-to-end cloud-native defense.

Let's examine the key security solutions Google Cloud’s Security offers among its portfolio:

• Threat Detection & Response:

  1. Google Security Operations (formerly Chronicle) delivers cloud-native SIEM, SOAR, and threat detection at scale, connecting security and IT teams for faster resolutions through advanced analytics and machine learning capabilities.

  2. Mandiant provides comprehensive threat intelligence, incident response, and managed defense services, enhancing organizations' ability to detect and respond to sophisticated cyber threats through expert-led services and frontline intelligence.

  3. Security Command Center serves as a GCP-native security and risk management platform offering visibility and control over cloud assets, with vulnerability scanning, threat detection, and compliance monitoring in a single dashboard.

• Zero Trust Architecture:

  1. BeyondCorp Enterprise implements a zero-trust access model, enabling secure, identity-aware access to applications and resources without traditional VPN requirements, shifting security from the network perimeter to individual users and devices.

• Application & Website Security:

  1. reCAPTCHA Enterprise protects websites from automated abuse by distinguishing between human and bot traffic, helping organizations defend against credential stuffing, account takeover attempts, and other automated attacks.

  2. VirusTotal provides a comprehensive malware intelligence service that analyzes suspicious files and URLs to detect malware and other breaches, serving as a central repository for threat intelligence sharing across the security community.

• Compliance & Governance:

  1. Assured Workloads helps organizations meet compliance requirements by applying security controls to cloud environments, enabling teams to configure and operate workloads according to specific regulatory frameworks such as HIPAA.

Optimizing Google Security Platform Usage

• Leverage Security Operations Platform Capabilities:

  • Utilize Google Security Operations' built-in YARA-L rules for advanced threat detection without coding. Create reusable detection rules and set up automated response workflows that trigger based on specific security events.

  • Take advantage of the UDM (Unified Data Model) to have a common schema for searching across all your data sources.

• Data normalization and enrichment:

  • Ensure data quality by implementing proper log forwarding configurations and data transformation processes. Security data can be sent to Google Security Operations and automatically normalized via UDM for consistent analysis.

  • Use VirusTotal to analyze suspicious files, domains, and URLs with comprehensive threat analysis data.

• Use the Security Command Center effectively:

  • Leverage the Security Command Center to monitor your Google Cloud resources for vulnerabilities and security risks.

  • Implement Cloud Functions to automate responses to security events detected by the Security Command Center.

Security Application and Version Updates

• OCSF recently released its latest version, v1.5.0, with the following updates:

  • New Event Classes: Two significant new event classes were added - "Application Security Posture Finding" in the Findings category and "Live Evidence Info" in the Discovery category.

  • Relationship Modeling: Added comprehensive relationship modeling capabilities with new graph, node, and edge objects for representing resource relationships.

  • New Dictionary Attributes: Numerous attributes were added, including boot_uid, cpid, raw_data_size, display_name, fix_coverage, and observation-related attributes to support security posture assessment.

  • Enhanced Observables: New observable types were added for process_entity.uid, email components (subject, uid), message_uid, reg_value.name, advisory.uid, file_path_t, and reg_key_path_t.

  • Authentication Improvements: Added authentication_token object and Kerberos ticket support with attributes like kerberos_flags and is_renewable.

• PAN-OS 11.2 introduces several key updates, particularly in content inspection and security. Key highlights include:

  • Content Inspection Enhancements: PAN-OS 11.2 brings Support for Brotli Decompression (introduced in PAN-OS 11.2.4), which improves the analysis and threat detection of HTTP content. This allows for inspection of traffic that was previously dropped, enhancing security.

  • Advanced DNS Security: A new subscription that detects and blocks DNS responses from hijacked and misconfigured domains in real-time. This feature uses cloud-based detection engines and ML-based analytics.

  • Local Deep Learning for Advanced Threat Prevention: This feature enhances threat detection by performing fast, local, deep learning-based analysis of zero-day and evasive threats.

Insights: From Our Integration Factory

• Google SecOps + OT Security: This integration of the OT Security platform with Google Security Operations (SecOps) aims to extend centralized threat detection and response capabilities to specialized IoT/OT devices.

  This integration aims to provide a unified security experience, allowing security teams to monitor and manage both traditional IT assets and specialized IoT/OT devices within Google SecOps. It bridges the gap between IT security and OT security, offering a comprehensive view of the organization's security landscape and enabling correlated analysis across environments.

• Cyera + CNAPP: This integration between Cyera and a CNAPP strengthens security of the cloud-native environment by unifying data-centric insights with runtime controls.  This integration aims to offer:

  • Improved Visibility and Risk Prioritization: Cyera can map sensitive data flows across multi-cloud workloads and correlate them with the CNAPP’s runtime telemetry to surface high-risk exposures.

  • Strengthened Threat Detection and Response: Cyera flags abnormal data access patterns and cross-references them with CNAPP’s real-time alerts. This allows rapid detection of attacks and cuts off access before damage escalates, which ultimately helps in reducing dwell time.

  • Automated Access Governance: Cyera identifies overprivileged identities accessing classified data, while the CNAPP can dynamically revoke excessive permissions.

• Palo Alto Networks - Cortex XSOAR  + MDR: This integration between Cortex XSOAR and MDR accelerates threat resolution through:

  • Unified Cross-Team Threat Intelligence: MDR can share data about how attackers operate, which XSOAR can use to organize information into workflows. This helps security teams replicate investigations and strengthen defenses by blocking malicious domains or patching vulnerabilities.

  • Proactive Compliance and Audit Readiness: Cortex XSOAR auto-documents MDR findings, response actions, and remediation evidence into audit-ready reports. This ensures compliance with frameworks such as NIST or GDPR during incidents, with timestamps and action logs proving due diligence.