Cloud security

Foresite Cybersecurity announces it has been named the 2026 Google Cloud Security Partner of the Year in the North America category, presented at Google Cloud Next ’26 in Las Vegas. Organizations looking to operationalise AI-driven security on Google Cloud can learn more at next.foresite.com. Foresite delivers fully managed security operations on Google Security Operations (SecOps), enabling customers to detect and respond to threats in seconds, reduce investigation fatigue, and maintain continuous audit readiness without expanding internal teams. Expanding internal teams Operating as the human control layer for AI-driven security, Foresite combines Google’s agentic investigation capabilities with practitioner-validated accountability. Every autonomous investigation is reviewed and authorized by a named analyst before response actions are executed, giving customers clear visibility into how decisions are made and risk is managed. “The Google Cloud Partner Awards honor the strategic innovation and measurable value our partners bring to customers,” said Kevin Ichhpurani, President, Global Partner Ecosystem and Channels, Google Cloud. “We are proud to name Foresite a 2026 Google Cloud Partner Award winner, celebrating their role in driving customer success over the last year.” Continuous compliance capabilities As a Google Cloud Premier Partner with Security and MSSP specialisations, Foresite delivers managed services through its Catalyst platform — extending Google SecOps with operational governance, automation, and continuous compliance capabilities. Over the past year, the company expanded its SecOps delivery practice while sustaining 96% customer retention, reflecting growing demand for managed, AI-enhanced security operations. Across its managed services portfolio, Foresite delivers a 90% reduction in mean investigation time and sub-15-second automated threat response for its customers — enabling security teams to focus on strategic risk decisions rather than alert triage. Varying levels of security maturity Foresite’s approach to managed security operations on Google Cloud was the subject of an independent Technical Validation by Enterprise Strategy Group (now part of Omdia), commissioned by Google in August 2025. The report examined how Foresite’s Catalyst platform extends Google Security Operations to deliver threat detection, investigation, and response for organizations at varying levels of security maturity. "Our Technical Validation of Foresite's Catalyst platform examined how practitioner-led governance can extend Google Security Operations to deliver measurable detection and response outcomes. Google Cloud's Partner of the Year recognition independently confirms what our analysis identified — that platform-native expertise, rather than tool access, is what differentiates managed security outcomes for mid-market and enterprise organizations."— Tony Palmer, Practice Director, Omdia (formerly Enterprise Strategy Group). Enterprise-grade security operations “We're entering an era where AI can investigate threats at machine speed,” said Jeremy Hehl, Chief Evangelist at Foresite. “Enterprise organizations need confidence that those decisions are governed and aligned to real business risk. This recognition from Google Cloud reinforces our focus in helping customers operationalise AI security at scale.” Foresite is showcasing its Agentic SOC capabilities at Google Cloud Next ’26, demonstrating how security teams can move beyond alert monitoring to govern autonomous response using Google SecOps, Google Threat Intelligence, and AI security controls. Foresite is purpose-built for organizations that need enterprise-grade security operations without enterprise-scale friction. The company delivers the operational rigor and platform expertise these organizations require to run Google SecOps effectively — without the overhead of building and staffing a full internal SOC.

Foresite Cybersecurity, a provider of managed security services, cyber consulting, and Google Cloud security solutions, today announced a strategic partnership with Bindplane, the OpenTelemetry-native Unified Telemetry Pipeline, to establish a new, advanced architecture for data ingestion within Google Security Operations (SecOps) environments. This collaboration leverages Bindplane as the official, engineered solution replacing the default Chronicle Forwarder, enabling customers to achieve superior data collection, processing, and routing at scale. Modern threat detection and response rely on the speed and integrity of the data pipeline. Bindplane's OpenTelemetry foundation and unified control plane allow for the centralized management of telemetry collectors across hybrid and multi-cloud systems. In-flight data transformation This capability ensures Foresite can deliver a higher fidelity data set by enabling in-flight data transformation, enrichment, and masking for compliance—critical factors for leveraging the full power of Google SecOps, Security-led AI, and Mandiant threat intelligence. "Bindplane is proud to collaborate with forward-thinking partners like Foresite Cybersecurity, who push to offer greater transparency and security in the managed services space through OpenTelemetry-powered offerings for their customers as threat landscapes evolve at an unparalleled pace," explained Mike Kelly, CEO of Bindplane. Managed services partner "At Bindplane, we help some of the largest companies in the world take ownership of and gain control over their telemetry data. Through our new role replacing the Google SecOps default Chronicle Forwarder and this strengthened alliance, we ensure all Foresite customers have the data visibility and agency required to maintain secure, efficient SecOps." Foresite was selected as one of the first strategic delivery partners globally to actively shape the Bindplane integration for Google SecOps customers. This early involvement is supported by our proven methodology, which streamlines Google SecOps deployment and optimization, cutting implementation timelines by up to 90%. This specialization solidifies Foresite's position as a dominant implementation and managed services partner in the Google Cloud security ecosystem. Proven customer success "Effective security posture is built on the foundation of data clarity and operational execution," said Jeremy Hehl, Chief Evangelist at Foresite. "This alliance with Bindplane is an investment in that principle. By standardising on a robust data ingestion layer, we ensure our clients receive unparalleled quality and trust in their telemetry, allowing us to focus on threat detection and response that delivers measurable progress and strengthens their security posture." Foresite continues to build upon its deep knowledge in areas like security engineering and incident response, empowering businesses to confidently navigate the ever-evolving cloud threat landscape. This partnership further establishes Foresite as a Google-first security partner dedicated to achieving the highest levels of technical proficiency and proven customer success in complex Google Cloud environments.

Foresite, a provider of managed security services, cyber consulting, and Google Cloud security solutions, announces it has achieved two key milestones in the Google Cloud Partner Advantage program: the Security Services Specialization and the Expertise in Google SecOps Service Delivery. These achievements reinforce Foresite's dedication to delivering best-in-class security solutions and services on Google Cloud, empowering enterprises to strengthen their security posture and protect their critical assets from today's and tomorrow's threats. Foresite's proven methodology streamlines Google SecOps deployment, cutting implementation timelines by up to 90%. Managed security services These achievements build upon Foresite's existing expertise across several critical Google Cloud security domains, including Google Cloud Identity & Security, Compliance Modernisation, Incident Response, Security Analytics & Operations, and Application Security. Foresite is among a select group of partners globally to achieve both the Security Services Specialization and the Google SecOps Service Delivery Expertise, solidifying its position as a trusted Google Cloud Security partner. Foresite adds velocity in the pursuit of reducing risk and achieving security outcomes with Google Cloud Security solutions, leveraging the speed and scale of Google Cloud, Security led AI, and the best of Mandiant, Google, and VirusTotal Threat Intelligence. Foresite's proven methodology streamlines Google SecOps deployment and optimization, cutting implementation timelines by up to 90%.

Tenable® Holdings, Inc., the exposure management company, today announced the expansion of the CyberAgents Exchange, powered by Tenable, to further accelerate enterprise security adoption of open-source AI agents, skills and MCP servers. Engineered by Tenable using OpenAI GPT cyber models, the CyberAgents Exchange AI Inspector (Exchange Inspector) evaluates selected AI components listed on the Exchange, including an enterprise-grade safety review, which is designed to help organizations more securely deploy in production environments. Vendor-agnostic hub The CyberAgents Exchange is an open-source, vendor-agnostic hub where security professionals discover and share AI agents, skills, MCP servers and playbooks built for cybersecurity. Exchange Inspector was developed as part of Tenable’s participation in the OpenAI Daybreak Defense Network. Exchange Inspector is a three-part vetting process that begins with Tenable One AI Exposure's skills inspection engine, which is designed to detect malicious content, such as prompt-injection and the exposure of hardcoded secrets or customer data. The component then undergoes a frontier model assessment using OpenAI GPT cyber models, followed by expert review by Tenable's security research team. Daily prioritisation plan Tenable carefully selects AI components that have demonstrated measurable results for Exchange Inspector vetting. Featured Exchange Inspector-vetted skills available today include: SOC Hunter - an AI skill that brings structured, proactive threat hunting to incident response workstations. The contributor, Tenable’s enterprise security team, reports cutting hunt times by 75%. SOC Hunter leverages hypothesis-driven threat hunting using the LOCK pattern across SIEM, EDR, VM, CSPM, CASB and code search. Remediation Priority & Impact Agent - an AI skill that develops a daily prioritisation plan for vulnerability remediation by combining live exposure data from Tenable, CISA KEV exploitation, MITRE ATT&CK and attack paths. They estimate the Remediation Priority & Impact Agent can reduce analyst triage time by up to 20X per cycle. Splunk Tenable Cloud Security Skill - a multi-model skill that enables security teams to query and triage Tenable One Cloud Security posture findings already ingested in Splunk using production-safe, count-first SPL via the official Splunk MCP Server, reclaiming dozens of hours of analysts’ time every week. Advanced AI discovery engine “With Tenable, security teams can accelerate AI innovation while maintaining rigorous security standards,” said Vlad Korsunsky, Chief Technology Officer, Tenable. “Leveraging Tenable One AI Exposure’s advanced AI discovery engine and frontier assessment using OpenAI GPT cyber models, the Exchange Inspector provides an additional layer of review for this rapidly growing subset of agents, skills and MCP servers before deployment. The CyberAgents Exchange symbolises trusted AI innovation, enabling CISOs and security teams to deploy AI more safely across the enterprise.” “The cybersecurity community has come together in a truly meaningful way on the CyberAgents Exchange," said McCall McIntyre, Head of Global Cyber Partnerships, OpenAI. "We are excited to work with Tenable on this important initiative to help deliver the trust layer required to more safely scale agentic AI across the enterprise.” Read today’s blog, “Inside the Exchange Inspector: How Tenable uses OpenAI GPT cyber models to review open-source AI agents,” for more details on the CyberAgents Exchange components that have been Exchange Inspector-vetted. AI component inspection is powered by Tenable One AI Exposure – the same skills inspection technology that can secure the agents already running across the environment.

The sheer volume of smart locks, lock management systems, connected readers and an increasing array of Internet of Things (IoT) devices complicates the issuance and management of certificates that are foundational to establishing trust between a device and the credential used to access it. That’s why more companies are turning to PKIaaS for IoT devices. But there’s another reason to consider PKIaaS: the rise of quantum computing. Secure digital communications Gartner predicts that the pace of quantum computing will render asymmetric cryptography systems PKI certificates form the backbone of secure digital communications, but Gartner predicts that the pace of quantum computing will render asymmetric cryptography systems unsafe by 2029 and could render all current cryptography unsafe by 2034. As with any software implementation, there are pitfalls to avoid, including vendors that use proprietary technology that’s incompatible with other systems and “gotcha” pricing tactics where a slight increase in certificate usage triggers a massive increase in pricing. However, the time to implement PKIaaS is now. Physical security faces growing cyber threats Although ransomware attacks directly on computing infrastructure dominate business headlines, physical security systems are also under threat. An HID survey of over 1,200 security professionals, end-users and executives shows that 75% reported threats to their physical security systems in the past year, as these systems are more tightly integrated with company IT networks. Until recently, most physical access control systems (PACS) were proprietary and worked only on the specific systems they were designed to interact with. However, the movement toward open supervised device protocol (OSDP) revolutionized the field, allowing companies to integrate and control devices from different vendors while improving compatibility and security. PACS and IoT devices  PKIaaS makes sense as the number of digital certificates needed to power PACS and IoT devices As a result, 40% of companies plan to either update or change access control systems in the next year, with 21% emphasizing the need for open standards like OSDP to both improve interoperability and future-proof their systems. When asked about reasons for a proposed upgrade, more than half cited convenience, while another 40% sought to improve their overall security posture. PKIaaS makes sense as the number of digital certificates needed to power PACS and IoT devices continues to increase, promoting security and reducing manual processes related to tracking certificates. Regulatory compliance demands automation and agility Companies also face increased regulatory pressures regarding technology in general — and certificates in particular. The European Union’s Cyber Resilience Act sets mandatory cybersecurity standards for manufacturers and retailers, covering the planning, design, development and maintenance of products throughout the entire value chain. Certain high-risk products must undergo third-party evaluation by an authorized body before being approved for sale in the EU. EU Cybersecurity Act shows a unified certificate framework for ICT products, services, and processes More specifically, the EU Cybersecurity Act establishes a unified certification framework for information and communications technology (ICT) products, services, and processes. Businesses operating in the EU will benefit from a “certify once, recognized everywhere” approach, meaning that approved ICT offerings will be accepted across all EU member states. Given the global nature of PACS, these regulations likely will impact companies well beyond the EU, much like the general data protection regulation on websites has. These changes, when considered together with rapid advancements in quantum computing, underscore the need for a unified certification solution such as PKIaaS to handle increased — and increasingly complex — certificate compliance. A path to PKI modernization Modernizing PKI through a PKIaaS model doesn’t have to be difficult. With a clear and phased approach, most organizations can transition smoothly while reducing risk and improving efficiency. It starts with a quick assessment of current certificate usage to understand where certificates are issued, how they’re renewed and any gaps in coverage. From there, it's about defining what you need and selecting a trusted partner. Look for a solution that integrates well with your existing systems, supports automation and scales as your needs grow. In terms of partners, not all PKIaaS vendors are the same. Look for one with a strong security track record and predictable pricing, which will simplify both onboarding and long-term management. When it comes to vetting vendors, ask the following questions: Is the solution scalable? The trend toward future-proof installations has never been greater. As the number of certificates increases, any PKIaaS solution must be able to grow in concert. How will pricing change as certificate volume grows? Some solutions are priced in tiers by the number of certificates. If a company exceeds that maximum by even a single certificate, it owes not only the price difference between tiers, but it will also be expected to pay for that tier the following year, which can bring a significant financial surprise. How are CAs accessed and stored? Look for companies that can provide long-term offline secure storage of certificates that can also track when CA keys are accessed. What support is included in the PKIaaS? Specifically ask vendors about up-front costs for implementation and onboarding to get a real apples-to-apples comparison among partners. Step-by-step replacement of manual processes A pragmatic approach allows corps to move quickly and confidently from legacy PKI to a scalable Once a vendor in place, start with a focused rollout, e.g., automating certificate renewals for internal systems or a specific business unit. Once the pilot is complete, expand automation with a step-by-step replacement of manual processes to limit operational disruptions. Finally, as PKIaaS becomes embedded in day-to-day operations, it’s important to align it with broader security governance. Establishing regular reporting and clear policies, as well as future-proofing for quantum-safe cryptography to ensure long-term resilience and compliance without adding complexity. This phased, pragmatic approach allows organizations to move quickly and confidently from legacy PKI to a scalable, secure and future-ready solution. A necessary upgrade According to an analyst report, manual certificate management can cost organizations up to $2.5 million annually in labor and outage-related expenses. While automation reduces these costs by up to 65%, the real challenge in IoT environments lies in managing scale. With device lifecycles often spanning decades and certificate volumes reaching millions — especially across distributed, resource-constrained endpoints — manual PKI processes and legacy infrastructure simply can't keep up. The convergence of regulatory mandates, quantum computing threats and rising cyber risks to connected physical systems makes scalable, cloud-based PKIaaS not just a strategic advantage, but a foundational requirement for secure IoT deployments.

Where and how to store security camera footage usually depends on the scale of the video surveillance project, the way you are using to record the video and how long you want to keep the recordings. If there are only few IP cameras, say 2~3 IP cameras for example, and you don’t need to keep the recordings for the month, usually using SD card which is installed in the camera is enough. Video management software A VMS provides a unified platform to manage all cameras and record footage onto centralized local storage servers If there are more than four cameras, even up to 128 cameras, NVR or CVR become the practical choice for managing and storing recordings reliably. However, if there are hundreds or thousands cameras, which need to managed and recorded, in this way video management software with centralized recording storage becomes essential. A VMS provides a unified platform to manage all cameras and record footage onto centralized local storage servers. S3-compatible cloud platforms Critically, if the VMS supports the S3 object storage protocol, users gain the flexibility to store recordings on S3-compatible cloud platforms (public or private), offering significant hardware cost savings and enhanced scalability. For such demanding environments, selecting a VMS built on an open platform architecture is strongly advised, ensuring the system can expand infinitely to meet future project growth. Video surveillance management system Users can seamlessly add subordinate servers (or disk groups like IPSAN/NAS), disk arrays, and network bandwidth Take the video surveillance management system SVMS Pro as an example. Its foundation is an open 1+N stackable architecture, enabling unlimited expansion of recording storage servers. Users can seamlessly add subordinate servers (or disk groups like IPSAN/NAS), disk arrays, and network bandwidth.  This achieves extended recording durations and boosted storage performance while maintaining system stability during sustained operation (assuming environmental requirements are met). Key architectural advantages Each centralized storage module based on a Linux OS, supports up to 200 front-end video channels per server. Its N+1 stackable expansion capability utilizes a distributed architecture, forming clusters of storage servers. Scaling the project involves simply adding subordinate storage modules – no modifications to existing deployments are required. Seamless S3 object storage integration Furthermore, SVMS Pro features deep integration of the S3 object storage protocol Furthermore, SVMS Pro features deep integration of the S3 object storage protocol. This allows seamless connection to major public cloud services like Alibaba Cloud OSS, Tencent Cloud COS, and Amazon S3 cloud, as well as private S3-compatible object storage solutions. This integration delivers truly limitless capacity expansion, leveraging the inherent elasticity of the cloud to effortlessly accommodate petabyte-scale video growth. Dual insurance: Multi-layered data protection The critical value of security data comes with inherent risks; losing video footage can lead to immeasurable losses. To mitigate these risks comprehensively, SVMS Pro innovates with its "Local + Cloud" Dual-Backup mechanism, leveraging S3 features to build multiple security layers: Real-Time Dual-Writing: Recordings are first written to the local disk (acting as a cache buffer). Upon local persistence, data is simultaneously replicated to cloud-based S3 storage, guaranteeing instant failover if either node fails. Smart Hot/Cold Tiering: Frequently accessed ("hot") data remains on high-performance local storage, while historical footage is automatically archived to low-cost cloud tiers, optimizing storage expenses. Cross-Regional Disaster Recovery: Utilizing the multi-replica and cross-region replication features of carrier-grade S3 storage inherently protects against physical disasters like earthquakes or fires. Additionally, the platform ensures comprehensive data protection through integrity verification and encrypted transmission, safeguarding data integrity and confidentiality across its entire lifecycle – from storage and transmission to access. Conclusion In essence, selecting the optimal storage solution for security footage hinges on a fundamental understanding of scalability requirements, retention needs, and data protection imperatives. As surveillance deployments grow from a few cameras to enterprise-scale systems, the underlying architecture must evolve: Localized storage (SD cards/NVRs) suffices for limited scope and short retention. Centralized VMS platforms become essential for unified management at scale, with open, modular architectures providing critical future-proofing for expansion. S3 object storage integration represents a paradigm shift, decoupling storage capacity from physical hardware and enabling truly elastic, cost-efficient scaling – both on-premises and in the cloud. Ultimately, successful large-scale video surveillance storage relies on architecting for flexibility, embedding data protection intrinsically, and strategically leveraging object storage protocols to balance performance, cost, and resilience – principles essential for safeguarding critical security data now and in the future.

The physical security industry has been in love with the cloud for quite some time. And understandably so. The promise of instant scalability, centralized access, and simplified maintenance is hard to ignore, especially in an era of remote work and distributed facilities. But reality is catching up to the hype. For many, especially those dealing with video surveillance at scale, the cloud is no longer the catch-all solution it once seemed. Rising costs, bandwidth limitations, and latency issues are exposing its shortcomings. And the more resolution increases, from HD to 4K and beyond, the heavier that burden becomes. Modern security cameras This is where edge computing, specifically AI-enabled edge processing available in modern security cameras, starts to look less like an option and more like a necessity. But it’s not just about adding intelligence to cameras. It’s about how that intelligence is deployed, scaled, and maintained. This leads us to containerization and tools such as Docker, which are a revolutionary piece of the puzzle. When cloud isn't enough Cloud analytics for video sounds great in theory: stream everything to the cloud Let’s start with a basic issue. Cloud analytics for video sounds great in theory: stream everything to the cloud, let powerful servers do the thinking, then serve up results to end-users in real time. However, in practice, this model can break down quickly for many end-users. Raw video is heavy. A single 4K camera streaming 24/7 can generate terabytes of data per month. Multiply that by hundreds or thousands of cameras, and the bandwidth and storage costs become unsustainable. Then there’s latency. If AI needs to detect a person entering a restricted area or identify a license plate in motion, seconds count. Routing video to a cloud server for analysis and waiting for a response can introduce delays. Adding in concerns about uptime, such as what happens if the internet connection goes down, it becomes clear why relying exclusively on the cloud creates friction for mission-critical deployments. The edge advantage Edge processing turns that model on its head. Instead of sending everything out for analysis, edge-enabled cameras do the heavy lifting on-site. AI algorithms run directly on the device, interpreting what they see in real time. They generate metadata—lightweight descriptions of events, objects, or behaviors—rather than raw video. This metadata can be used to trigger alerts, inform decisions, or guide further review. The benefits are obvious: latency drops, bandwidth use plummets, and storage becomes more efficient. Edge processing solves many cloud deployment issues by keeping the compute where the data is generated, on the device. This frees the cloud up to do what it’s best at: providing scalable and centralized access to important footage. But where does the edge go from here? How do we evolve these powerful IoT devices to deliver even more situational awareness? Enter Docker: An app store for edge AI They package an app along with everything it needs to run: the code, settings, libraries, and tools This is where the concept of containerization and open development platforms like Docker comes in. Let’s start with an analogy that is helpful for understanding containers. Imagine you're getting ready for a trip. Rather than hoping your hotel has everything you need, you pack a suitcase with all your essentials: clothes, toiletries, chargers, maybe even snacks.  When you arrive at your destination, you open the suitcase and you’re ready to go. You don’t need to borrow anything or adjust to whatever the hotel has, since you’ve brought your own reliable setup. Containers in software work the same way. They package an app along with everything it needs to run: the code, settings, libraries, and tools. This means the application behaves exactly the same, whether it’s running on a developer’s laptop, on the edge in an IoT device, or in the cloud. Security camera with a powerful edge processor There’s no last-minute scrambling to make it compatible with the environment it lands in, because it’s self-contained, portable, and consistent. Just like a well-packed suitcase simplifies travel, containers simplify software deployment. They make applications faster to start, easier to manage, and more predictable, no matter where they’re used.  For a security camera with a powerful edge processor, it’s like giving the camera its own specialized toolkit that can be swapped out or upgraded without touching the rest of the system. It also means you can run multiple AI applications on a single camera, each in its own isolated environment. Integrators and end-users These applications don’t interfere with each other and can be updated independently Want to add fall detection to a healthcare facility’s camera network? Just deploy the analytics in a container. Need to monitor loading docks for pallet counts at a warehouse? Spin up a different container. These applications don’t interfere with each other and can be updated independently.  As a developer, if you use an open container platform like Docker, any system that supports Docker can utilize your software. This removes the need to do expensive custom work for each partner and ecosystem. This is one reason Docker containers are tried and true in the larger IT space and are just starting to get traction in the security sector. Docker also makes this scalable. Developers can build AI tools once and push them out to hundreds or thousands of devices. Integrators and end-users can customize deployments without being locked into proprietary ecosystems. And because containers isolate applications from core system functions, security risks are minimized. Metadata, not megabytes Traditional video analytics systems often require full video streams to be processed One of the most underappreciated aspects of this method is the way it redefines data flow. Traditional video analytics systems often require full video streams to be processed in centralized servers, either on-premises or in the cloud. This model is brittle and costly, and it’s also unnecessary. Most of the time, users aren’t interested in every frame. They’re looking for specific events. Edge AI enables cameras to generate metadata about what they see: “Vehicle detected at 4:02 PM,” “Person loitering at entrance,” “Package removed from shelf.” This metadata can be transmitted instantly with minimal bandwidth. Video can still be recorded locally or in the cloud, but only accessed when needed. This dramatically reduces network load and allows the cloud to be used more strategically: for remote access, long-term archiving, or large-scale data aggregation, without being overwhelmed by volume. Building smarter systems, together A single camera can run analytics from multiple third parties, all within a secure, containerized framework An equally important aspect of containerization is how it opens up the ecosystem. Traditional security systems are often built as closed solutions. Everything—from the cameras to the software to the analytics—comes from a single vendor. While this simplifies procurement, it limits innovation and flexibility. Docker flips that model. Because it’s an open, well-established standard, developers from any background can create applications for edge devices. Integrators can mix and match tools to meet unique customer needs. A single camera can run analytics from multiple third parties, all within a secure, containerized framework. This is a profound shift. Security cameras stop being fixed-function appliances and become software-defined platforms. And like any good platform, their value increases with the range of tools available. Hybrid: The realistic future So, where does this leave the cloud? It is still essential, but in a more specialized role. The most robust, future-proof architectures will be hybrid: edge-first and cloud-supported. Real-time detection and decision-making happen locally, where speed and uptime matter most. The cloud handles oversight, coordination, and data warehousing. Real-time detection and decision-making happen locally, where speed and uptime matter most This hybrid model is especially useful for organizations with complex deployments. A manufacturing plant might retain video locally for 30 days but push older footage to the cloud to meet retention requirements. A retail chain might analyze customer flow on-site but aggregate trend data in the cloud for HQ-level insight. Hybrid gives organizations the flexibility to optimize cost, compliance, and performance. Regulatory realities It’s also worth noting that not every organization can, or should, store data in the cloud. Privacy regulations like GDPR in Europe or similar laws elsewhere require strict control over where data is stored. In many cases, sensitive footage must remain in-country. Edge and hybrid models can make compliance easier by minimizing unnecessary data movement. Conclusion: Smart security starts at the edge The next wave of innovation in physical security won’t come from bigger cloud servers or faster internet connections. It will come from smarter edge devices, with cameras and sensors that don’t just record, but understand and classify events. And the foundation for that intelligence isn’t just AI, but how that AI is deployed. Containerization via platforms like Docker is unlocking new levels of flexibility, security, and scalability for the physical security industry. By embracing open standards, supporting modular applications, and rethinking how data flows through the system, physical security professionals can build solutions that are not only more effective but also more sustainable, secure, and adaptable. The cloud still has its place. But the edge is essential to the future for real-time intelligence, mission-critical uptime, and cost-effective deployment.

There was high-level energy at GSX 2025, befitting an industry undergoing massive change. Artificial intelligence (AI) was everywhere, but not so much in the booth signage. Rather, AI has made its way beyond marketing claims and solidly into the core of the products themselves. There were hundreds of examples of how AI is changing how security systems operate, all for the better. Clearly on display at GSX 2025 was an industry in the midst of metamorphosis.  Deep integration of AI My conversations with companies across the security ecosystem revealed an industry heavily focused on leveraging advanced technologies like AI and the cloud to address increasingly complex global and localized threats. Several key themes emerged at the Global Security Exchange (GSX), sponsored by ASIS International, held Sept. 29–Oct. 1 at the Ernest N. Morial Convention Center in New Orleans, La. Themes I heard repeated throughout the show floor included deep integration of AI, the ongoing shift toward cloud-based and hybrid architectures, and a sharp focus on modernizing security systems to meet current challenges. AI and intelligent automation transform security The use of GenAI is moving beyond simple search functions into real-time decision support Companies are integrating AI and intelligent technologies to enhance analytics, streamline incident response, and improve internal efficiency. The use of Generative AI (GenAI) is moving beyond simple search functions into real-time decision support. For example, Bosch Video Systems introduced a "second tier" to its video analytics capabilities by combining highly sensitive edge detection with GenAI models in the cloud. For example, in visual gun detection, edge analytics might flag a potential gun (yellow), but the cloud-based GenAI then quickly reviews and confirms the threat (red), helping to filter out false alarms. Bosch is also using GenAI for more open-ended searches, such as a "Where's Waldo" application demonstrated at their booth. GenAI-powered system  Eagle Eye Networks says they are focused on helping integrators "organize the AI chaos” through their cloud-based video platform. Their precision person and vehicle detection capabilities work across multiple cameras. Motorola Solutions introduced Inform, an AI-assisted incident response solution designed to bring clarity to the "noise" and help security teams respond to complex threats. They also offer Avigilon Visual Alerts, an on-prem GenAI-powered system that expands the natural language interface. AI internally to improve processes The Body Workforce Mini protects frontline workers and businesses "amid rising violence and theft." The Axon Body Workforce Mini, a small “computer with a lens” for non-police applications, is AI-capable and can perform real-time translations, automated report writing, and summarization, and can even act as a personal assistant by incorporating company policies. All those functions are built into a lightweight body-worn camera designed to safeguard frontline workers in retail and healthcare verticals. The Body Workforce Mini protects frontline workers and businesses "amid rising violence and theft." Beyond products, integration company Everon is using AI internally to improve processes, such as handling commoditized tasks, which they expect will result in better customer satisfaction. Everon wants to be known as a premier service provider and will be introducing new services in the video realm. AI-powered search and continuous system upgrades Genetec prefers the term Intelligent Automation (IA), instead of AI, to describe its empathetic interface, which can "know" what additional information a security professional needs when they click on an image, for example. Genetec says the advantages of the cloud include AI-powered search and continuous system upgrades. Their Security Center SaaS has had a fast and successful launch. It enables cloud-based systems with local storage.  Genetec also highlighted the Cloudlink 210, a cloud-managed appliance designed to unify physical security operations that can be simply plugged in without involving IT staff. They call it a “headless appliance.” Cloud migration and the push for hybrid systems Hanwha debuted OnCAFE (Cloud Access for Everyone), a new cloud-based access control product The industry continues its strategic march toward the cloud, often through hybrid applications that blend on-prem strength with cloud flexibility. Acre's access control is described as "cloud-first technology," and they continue to focus on cloud solutions, incorporating AI. To help customers transition, they offer the "Bridge," a migration tool that allows systems to communicate throughout the move. At the same time, they are continuing to develop and enhance their core on-prem products – DNA Fusion and AccessIt!. Adding access control to supplement their video product line, Hanwha debuted OnCAFE (Cloud Access for Everyone), a new cloud-based access control product. The goal is to provide “access control that is easy;” It works alongside their OnCloud direct-to-cloud VMS as a Service platform. Future of video management The future of video management is increasingly hybrid. Milestone recently completed a three-year process of updating XProtect and building for the future of hybrid applications. At GSX, they showcased how their XProtect Evidence Manager seeks to "democratize evidence management" by collecting video, cell phone data, notes, and other metadata related to a case for easy sharing and prosecution. Also, Milestone’s “app center” enables additional features to enhance XProtect without involving integration.  Milestone is also focusing on "Metadata Ingest," which collects and aggregates data from various manufacturers (including Genetec, Motorola, and Exacq) for use by AI. Strategic modernization and open integration Convergint and Genetec collaborated on a "2026 Technology Modernization Outlook" white paper A key theme for the future is the shift toward open systems and strategic modernization, enabling security professionals to better utilize new technology. Convergint and Genetec collaborated on a "2026 Technology Modernization Outlook" white paper, arguing that dealers and end-users need to think more strategically when buying technology. They predict that "2026 will be the year of modernization," with tangible results including unified intelligence, flexible deployment, and lower total cost of ownership. The call for open standards and architecture was also strong. What AI needs from open systems Johnson Controls noted that cloud, AI, and open standards are its three big focus areas. Their C-CURE IQ 3.10 is gaining adoption as it unifies access and video. OpenEye is seeking to address the "AI disruption anxiety" in the industry, focusing on what AI needs from open systems. The emphasis is on the value of a Model Context Protocol (MCP), an open standard and framework to enable AI systems to integrate and share data with external tools and sources. Addressing shifting global and local threats Allied Universal's "World Security Report 2025" highlights a risen focus on executive protection Companies unveiled solutions targeted at new security concerns, particularly the rising threat of violence, theft, and misinformation. Allied Universal's "World Security Report 2025" highlights an increased focus on executive protection and cites the rise of misinformation and disinformation as the number two threat. They noted that macro trends around instability and the political and social environment are driving security threats globally. To combat physical threats, Shooter Detection Systems introduced a new outdoor sensor, which is now generally available after a favorable feedback period that included an apprehension in one municipality. The company notes the unique challenge of developing technology for a "non-cooperative" threat like a person with a gun, in contrast to most security technologies that are "cooperative" and depend on user compliance. Implementation of integrated security Flock Safety is expanding its focus beyond license plate readers into solutions for retail, with a new initiative to automate and streamline investigative processes, which are often manual. The company also showcased "drones as automated security guards," which can be deployed within 90 seconds to provide "eyes" on a site and enhance safety. The system works on its own network and is firewalled away from the city system A tour of the City of New Orleans' Real Time Crime Center (RTCC), hosted by Axis Communications, demonstrated a mature implementation of integrated security. The RTCC uses Axis cameras, Genetec VMS, and is tied to a Motorola Solutions Command Center to enhance efficiency and effectiveness, operating independently of the police department. They measure success in terms of valuable hours saved in an investigation or even when an event is happening. The system works on its own network and is firewalled away from the city system. Rapidly changing industry on display The GSX 2025 highlights an industry that is moving toward more intelligent and integrated solutions. The investment in AI is shifting security from reactive monitoring to proactive, automated assistance. Throughout the show floor, the continued embrace of hybrid cloud architectures, coupled with an emphasis on open standards and modernization roadmaps, suggests a security ecosystem built for agility and future growth.  These trends, and the GSX show itself, collectively underscore the industry's commitment to delivering scalable, next-generation solutions for a changing threat landscape.

Multiple technology trends are transforming the physical access control market. There is a fundamental shift away from physical cards and keys toward digital identities — mobile credentials, digital wallets, biometrics, and cloud-native access platforms. These next generation access solutions are radically reshaping how buildings operate, protect staff, and perform functionally. At the same time, AI and analytics solutions are being layered onto these physical access control systems to support predictive threat detection and behavioral insights. Access data itself is becoming an asset for sustainability, space optimization, and smart building initiatives. Risk, impact operations and experience The annual HID Global Security and Identity Trends Report highlights these and other issues The annual HID Global Security and Identity Trends Report highlights these and other issues. The survey cites improving user convenience as a priority for nearly half of organizations, while 41% are focused on simplifying administration, and 28% struggle with system integration. These are not theoretical challenges, they are day‑to‑day friction points that add cost, increase risk, impact operations and experience, and, of course, must be addressed. HID Global’s commercial focus HID Global’s commercial focus is to help organizations digitize their access control — with mobile identities, biometrics, and cloud platforms — and then to use the data to deliver more value. “We are turning access control from an operational cost into a software-driven asset that improves efficiency, supports Environmental, Social, and Governance (ESG) goals and even creates new revenue opportunities,” says Steven Commander, HID Global’s Head of Consultant Relations. The impact of digital transformation Digital transformation is the method of moving access control from hardware and physical credentials Digital transformation is in the process of moving access control from hardware and physical credentials to a software-driven, integrated experience. The transformation strengthens security while also improving user convenience — transforming the “pavement to the desk” journey. HID enables this shift through mobile credentials, biometrics, cloud-native platforms, and solutions that allow third-party applications to run on door hardware. “This helps customers turn access data into operational and commercial outcomes, while also improving the overall user experience,” says Commander.  Digital transformation in access control is not focused on chasing the latest trends. Rather, transformation is about turning software, data and integration into outcomes that matter to customers, says HID. “Security becomes stronger and more adaptive,” says Commander. “Operations become simpler and more cost‑effective. Experiences become seamless and consistent. Sustainability moves from ambition to action. And the financial case becomes clearer as efficiencies are banked and new value streams emerge.” The challenge of futureproofing with long lifecycles Given that physical security technologies will be in place for 15 to 20 years, it is important to plan for how systems can evolve over time. Considering how rapidly security threats, compliance standards, and user expectations change, 15 to 20 years is a long time. The decisions made at the beginning of a system’s lifecycle can either limit flexibility later (which will be costly) or enable long-term adaptability. Support for open standards such as Open Supervised Device Protocol (OSDP) is therefore important Choosing products and platforms that are open, interoperable, and designed for updates can enable future-proof projects. Support for open standards such as Open Supervised Device Protocol (OSDP) is therefore important.  In addition, systems built on open controller platforms — such as Mercury — enable organizations to switch software providers or expand functionality without replacing core door hardware. Architectural openness is key to system lifecycles and maximizing the return on investment (ROI) from a chosen solution. Digital credentials and mobile access Flexibility and upgradeability should also be top of mind when it comes to endpoints like access control readers. While RFID cards are still commonplace, there is a clear trend toward digital credentials and mobile access. Readers that support both allow organizations to transition at their own pace, without committing to a full system overhaul. A long system lifecycle does not mean technology should remain static. Security, particularly cybersecurity, demands more frequent updates. Technologies that support firmware upgrades in the field extend the value of a deployment while helping organizations keep pace with emerging threats. In that sense, lifecycle thinking is not just about longevity — it’s about maintaining resilience and readiness over time. Applying biometrics and mobile identities Biometrics is becoming mainstream as a credential alternative, strengthening security without adding friction Biometrics is becoming mainstream as a credential alternative, strengthening security without adding friction. Many organizations are now deploying biometrics to support fast, seamless access journeys, with adoption already around 39% in access control according to HID’s recent research.  In addition, 80% of organizations surveyed expect to deploy mobile identities within the next five years. Full technology integration enables tap‑to‑access without opening an app; the user journey becomes faster, safer, and more convenient. “It is where the industry is headed and we are at the vanguard of this,” says Commander.    Ongoing challenge of cybersecurity At HID Global, cybersecurity is embedded into everything, from corporate processes and development practices to the solutions they bring to market. “Our approach ensures that customers can strengthen their overall security posture, not only by deploying secure products but by benefitting from HID’s commitment to the highest industry standards,” says Commander. HID holds multiple globally recognized certifications, including ISO 27001, ISO 14298, SOC Type 2, and CSA STAR, which demonstrate their robust information security and cloud security practices. In addition, HID’s SEOS® secure chipset is independently SEAL-certified, providing one of the most advanced levels of protection available on the market today. “Ultimately, this means organizations are not just purchasing isolated secure products; they are implementing solutions developed and delivered within a comprehensive, cybersecure framework,” says Commander. “When deployed according to best practices, HID solutions enable customers to achieve the highest levels of resilience against evolving physical and cyber threats.” Developing green and sustainable solutions A huge amount of waste is generated from the manufacture of plastic RFID access cards Digital credentials align with the sustainable solutions that everyone wants. A huge amount of waste is generated from the manufacture of plastic RFID access cards. Over 550 million access cards are sold annually. This creates 2,700 tons of plastic waste and 11,400 tons of carbon, based on a PVC card weighing 5 grams.  Therefore, digital credentials self-evidently reduce the reliance on plastic cards (helping reduce carbon emissions by up to 75% according to HID’s research), while leveraging access control system data supports energy optimization by shutting down or reducing systems in unused spaces. Energy use and CO₂ emissions can be cut dramatically, showing how access systems can contribute to sustainability goals and green building certification. What is the latest in smart buildings? Smart buildings increasingly rely on mobile access control as the backbone for digital services. Real-time access data enables new services such as automated room bookings, HVAC control, lift/elevator calling, e-bike hiring, and so on. Smart buildings increasingly rely on mobile access control as the backbone for digital services The financial upside is clear; smart, digitally transformed buildings can deliver around 8% higher yields per square foot versus traditional office space. Operational savings accrue from reduced administration, the removal of card production and shipping, and lighter IT support. This creates a value cycle — better experiences drive adoption, adoption fuels monetization, and monetization funds further improvements. Achieving technology impact in the real world One standout project is One Bangkok – a $3.9 billion mixed-use development in Thailand – which demonstrates the scale of what can be achieved when access control data is used for optimization, particularly when it comes to monitoring facilities usage and occupier behaviors. By switching lights off or lowering the temperature in unused rooms, for example, the One Bangkok building demonstrates this potential with a 22% reduction in energy consumption, saving 17,000 MWh and 9,000 tons of CO₂ annually.  Sustainability is a key factor in contributing to how properties are valued. And sustainability extends far beyond digital credentials having a lower environmental impact than plastic cards.  Buildings with recognized sustainability certifications often command rental premiums of around 6%, and three‑quarters of security decision‑makers now consider environmental impact in their procurement assessments.

For all the emphasis on cloud systems and centralized servers at ISC West, a lot of innovation in security video systems is happening at the edge. New advancements inside video cameras are boosting capabilities at the edge, from advancements in processing power to artificial intelligence (AI) and machine learning (ML) algorithms that can now be deployed directly on the cameras or edge devices. Advancements in AI algorithms The progress of video systems becoming smarter at the edge is driven by the need for real-time insights, lower latency, bandwidth efficiency, enhanced privacy, and improved reliability.  Advancements in edge computing hardware and AI algorithms are enabling a range of intelligent video applications across various industries, including physical security. Smarter functionality at the edge is a benefit of new computer systems-on-chips (SoCs) that are driving new heights of performance for today’s cameras.  Axis Communications’ ARTPEC-9   Axis Communications’ new ARTPEC-9 SoC offers advanced video compression to reduce bandwidth Axis Communication’s new ARTPEC-9 system-on-chip (SoC) offers advanced video compression to reduce bandwidth and storage needs. With a low bitrate, the SoC helps deliver high-quality imaging with outstanding forensic detail. ARTPEC-9 also offers enhanced deep learning capabilities to allow users to leverage the latest video analytics and accelerate the implementation of AI technology. Axis maintains control over all aspects of the chip’s development to ensure high quality and cybersecurity. Among the benefits of ARTPEC-9 are better AI and deep learning, better image quality, better cybersecurity, and AV1 license-free video compression (see below). Hanwha Vision’s Wisenet 9 Hanwha Vision has launched Wisenet 9, its most advanced AI-powered System on Chip (SoC). Wisenet 9’s enhanced edge AI capabilities increase performance as the volume and complexity of security threats demand real-time, accurate analysis. By elevating edge-device performance, AI empowers systems to quickly analyze vast amounts of video data and discern crucial patterns and anomalies. A key differentiator driving Wisenet 9 is deployment of two Neural Processing Units (NPUs), which improve performance three-fold compared to Wisenet 7, the previous SoC generation. While one NPU handles image processing, the other focuses on object detection and advanced analytics. This dual NPU concept was introduced to ensure video quality and analytics have independent resources, thus preventing one function from impacting the performance of the other. The latest from Ambarella Ambarella is a supplier of edge AI systems-on-chips to multiple video camera manufacturers Off the ISC West trade show floor in a nearby meeting room, semiconductor company Ambarella demonstrated how it will continue to push the envelope of what is possible with generative AI at the edge. Ambarella is a supplier of edge AI systems-on-chips to multiple video camera manufacturers and recently achieved the milestone of 30 million cumulative units shipped. The demonstrations highlight Ambarella’s ability to enable scalable, high-performance reasoning and vision AI applications across its ultra-efficient, edge-inference CVflow 3.0 AI SoC portfolio. The company’s DeepSeek GenAI models run on three different price/performance levels of its SoC portfolio. In addition to advancements in GenAI processing at the edge, Ambarella integrates image processing, encoding and system-level functions into all its AI SoCs. New standard for video encoding: AV1 AV1 compression is a next-generation video coding technology that offers significant improvements in compression efficiency and video quality, especially at lower bitrates. Its royalty-free nature positions it as a crucial codec for the future of internet video. AV1 compression is a next-generation video coding technology. Axis Communication’s ARTPEC-9 chip now supports the AV1 video encoding standard. By embracing this standard, which is new to the physical security market although it was introduced in 2018, Axis sets the stage for AV1 compression to eventually become the industry standard, replacing H.264 and H.265. Network video transmission AV1 is an open-source, license-free coding format designed mainly for efficient network video transmission AV1 is an open-source, license-free coding format designed specifically for efficient network video transmission. It delivers high-quality video at low bitrates, reducing bandwidth consumption and storage costs. The codec was developed by the Alliance for Open Media (AOM), a nonprofit organization founded in 2015 by Google, Intel, Amazon, Microsoft, Netflix, and Mozilla (among others), to provide open-standard, next-gen video coding technology. AV1 is ideal for cloud solutions—making streaming applications more robust, scalable, and capable of delivering real-time insights. Now the ARTPEC-9 chipset brings these benefits to the surveillance industry, and AV1 is currently supported by AXIS Camera Station. Providers of major video management solutions (VMS) such as Genetec and Milestone will be adding support for AV1, with further developments already underway. More intelligence at the edge Intelligence inside video cameras comes from the processing power and algorithms that enable them to perform tasks beyond simply capturing and recording images. This "intelligence" allows cameras to analyze the video stream in real-time, identify objects, detect events, and make decisions or provide alerts based on what they "see." New and improved SoCs are driving performance improvements at the edge. The increasing power of embedded processors and advancements in AI are continuously expanding the capabilities of intelligent video cameras.

Working in the heavily regulated and frequently targeted financial services industry, the client (a global financial services group) needed to ensure its cybersecurity posture was extremely robust to protect its infrastructure and customer data from threats. The previous threat detection solution posed challenges, notably with a high volume of false positives. Without a robust SIEM tool and relying on less effective UEBA processes, the team recognized the need to fortify its security framework to align with their stringent standards. Another key area of focus was enhancing visibility within their security infrastructure. The existing setup presented an opportunity for improvement in consolidating monitoring capabilities into a unified interface. Additionally, the team wanted to enhance oversight of active directory actions, specifically addressing enumeration attacks, and monitoring the controlled export of company data by internal users. The solution Brought in to increase visibility and reduce overall risk, RiverSafe suggested they implement Exabeam, which would provide the company with all the best-in-class UEBA tools needed. RiverSafe suggested Exabeam due to the platform’s efficient data processing, simple architecture, scalability, and ease of deployment. The off-the-shelf content within Exabeam’s UEBA dashboards and reporting tools offered another key benefit, giving the security team access to data pre-built models and statistics that would allow them to start monitoring and flagging events immediately. Finally, Exabeam’s smart timeline feature that merges all user activity into one stream would address the visibility issue. Security and monitoring purposes With the client ready to implement, RiverSafe deployed Exabeam on their AWS Environment following best practice guidelines. The team mapped out relevant log sources for the system, and onboarded all data streams, filtering and fine-tuning everything to ensure any information being ingested was relevant for security and monitoring purposes. RiverSafe then developed and deployed use cases scoped out in partnership with the client, helping them to get maximum value from their Exabeam implementation. This documentation included custom roles, models and parses, as well as other quality of life improvements, additional search filters, and guidance on maintenance and monitoring techniques. The outcome The client now has an established monitoring workflow for its security team that’s baked into their day-to-day tasks. The team can monitor the entire environment quickly, and has significantly reduced the time it takes to assess threats like phishing and brute force attacks, and investigate unusual internal behaviours. Following RiverSafe’s advice, the client has been able to scale its Exabeam solution by accessing the right hardware required to run the product efficiently. Data loss and maintaining data integrity Noise from the SIEM has been reduced thanks to the optimization work conducted on log source onboarding. This has resulted in less complexity, fewer false positives, and easier access to the precise information that the team really needs. The security team now has visibility into email, endpoint, active directory, and web activity, and is able to monitor these frequently targeted areas for suspicious events and behavior. This visibility now also extends to file activity, protecting the company from potential data loss and maintaining data integrity. Managing security data and identifying trigger points Siloes have been eliminated, with security insights now located in a single repository for maximum perceptibility. From server performance to traffic flows, whatever’s happening across its pan-global regions, the security team know about it. Exabeam has equipped the team with a simpler, more effective way of managing security data and identifying trigger points—resulting in a 30% reduction in time spent on threat hunting.

The client, a large telecommunications provider, had teams working across multiple time zones and operated a sprawling and complex IT system. The scale and density of this system made gaining visibility into IT services extremely difficult, leaving the security team blind to what was happening with its IT environment. With little-to-no operations monitoring tools in place to proactively monitor these systems, the team had no visibility on the availability of its IT services or KPIs such as failure rates, send request times, and response times. This lack of oversight made it difficult for the team to prioritise issues — and nearly impossible for them to find the root cause of any problem. Proactive measures Without the ability to investigate the source of issues, the team was unable to take proactive measures to prevent them from reoccurring, severely impacting service performance. This was not only a problem for IT teams, but also for executives, who lacked the insight into IT business operations that would help them make decisions. The solution The company needed a solution that would map KPIs to critical service components, enabling the operations team to effectively drill down into issues in real time and conduct in-depth investigations to find resolutions. RiverSafe had previously implemented Splunk Enterprise Security for the customer and given the success of the implementation and the positive client feedback on the platform, RiverSafe was again engaged to deploy Splunk’s IT Service Intelligence (ITSI) tool to help it tackle its visibility problem. Data collection metrics Splunk ITSI uses machine learning to analyse existing data and predict future issues. As well as forecasting potential services bottlenecks, it can also troubleshoot problems and help users resolve issues fast. Delivering comprehensive monitoring across the entire IT environment, Splunk ITSI would also give the team full observability of their IT infrastructure. In particular, the engineering team wanted to gather metric data relating to the Kubernetes platform. RiverSafe reconfigured and implemented data collection metrics used elsewhere in the IT environment in Splunk to allow engineers to collate and access this information from different data sources in one place. The outcome: Actionable insights in days, not weeks In less than a week, the RiverSafe team implemented Splunk ITSI and began running monitoring services. With data from existing KPIs already indexed by the Splunk platform, the team are now able to access service insights even faster. These KPIs allow the operations team to identify trends, detect patterns, and proactively address any anomalies that occur before issues arise. Instant visibility with glass table visualisations To enable rapid and proactive issue resolution, RiverSafe implemented custom glass table visualisations in Splunk ITSI. This enables the team to navigate large volumes of data and reduce the time needed to identify and resolve problems. This simple and accessible dashboard gives the team an instant, digestible overview of its web portal performance metrics. These KPIs included the number of open tickets and failed login attempts, memory usage, API call success rates, average response times, and overall health of container services. Event analytics in Splunk ITSI As a result of RiverSafe’s work, the team has been able to centralize events from all its previously siloed solutions into a single interface with Splunk ITSI. The event analytics in Splunk ITSI help to prioritise responses and react more quickly to customers’ infrastructure events, empowering them to provide a better service. This is thanks in part to Splunk ITSI’s ability to identify and filter out false positives from the event management process. Excluding these invalid events reduced the total event volume by 40%, helping operators focus on the events that really matter. With fewer events to process, a single interface to work from, and a streamlined event analytics framework in Splunk ITSI, operators now process events eight minutes faster on average. This boost in efficiency has led to a major improvement in the company’s SLA performance. Best practices for using Splunk ITSI Overall, Splunk ITSI has delivered enhanced operational visibility, meaning the team can locate bottlenecks in workflows quickly and deliver fast recovery and troubleshooting solutions. Along the way, RiverSafe also provided best practices for using Splunk ITSI and recommended the most effective ways to collect data, including proposing an alternative metric type that would save on storage space when collecting logs.

In the wake of a significant merger between two major telecommunications companies, the client, a newly formed telecom giant was looking to unify and modernise security operations across the entire organization. The merged entity needed to increase asset visibility for its critical business operations, reduce the sprawl of security tooling, and unify its systems. Additionally, the company was looking to improve its overall monitoring capabilities while addressing a substantial amount of technical debt that had accumulated both pre- and post-merger. This transformation would not only optimize operations but also ensure continued compliance with industry regulations. Recognising the complexity of this project, the client decided to bring on RiverSafe due to the specialized expertise and experience with SOC and SIEM transformation projects. The solution The programme of work began with a series of collaborative workshops, fostering a deep understanding of the company’s vision for its future security landscape. During this discovery stage, the RiverSafe team uncovered 12 legacy SIEMs existing within the organization. They began by consolidating a major cloud-based security platform, evolving it from three separate instances to a single, unified platform. This consolidation included integrating cutting-edge single sign-on capabilities, incorporating new data sources, and seamlessly migrating existing data parsers, dashboards, and lookups. Data management and routing To enhance data management and routing, RiverSafe implemented Cribl, a sophisticated data streaming platform. This allowed for efficient routing of data feeds to multiple destinations and enabled complex data transformation operations, providing the telecom company with greater flexibility and control over its data. The RiverSafe team further identified an opportunity to optimize the existing SIEM infrastructure and devised a strategic plan to consolidate operations onto two robust platforms: a cloud-based security operations platform for general use, and an on-premises SIEM solution to meet specific regulatory compliance requirements. The outcome The impact of this transformation was substantial. By optimising its SIEM platforms, the telecom company significantly improved its operational efficiency and security visibility. The streamlined infrastructure opened up new avenues for automation and data enrichment, further enhancing the company’s security capabilities. The implementation of the data streaming solution not only improved data routing efficiency but also led to substantial cost savings in licensing fees. Beyond these immediate benefits, the transformation laid the groundwork for future innovations through increased automation potential. It also further strengthened the company’s compliance with industry regulations and enhanced its overall security posture and monitoring capabilities.

With an extensive network of customers spanning the globe, cybersecurity is a primary concern for our client. Protecting extensive infrastructure and customer data requires a robust cybersecurity posture and effective tools, but the team found its SIEM solution lacking. Flooding its security team with an unmanageable number of false positives, the solution was diverting attention away from genuine threats and leaving them vulnerable. A substandard SIEM solution was not the only security issue. With no UEBA platform in place to help detect insider threats and data breaches, the company was faced with a number of gaps and weak spots in its security infrastructure that needed to be addressed. Three key issues The biggest concerns centred around three key issues: A lack of insider threat detection: Without a UEBA solution, the company had difficulty identifying insider threats and anomalous user behaviour within the network. Time spent on manual investigation: Security analysts spent significant amounts of time manually correlating events and investigating incidents, leading to delays in incident response and inefficient use of resources. Alert fatigue: The company’s existing SIEM solution generated a high volume of alerts, making it challenging for analysts to identify genuine threats among the many false positives. The solution The company engaged with RiverSafe to create a bespoke implementation plan that would address its primary issues and properly secure its digital infrastructure. Working in collaboration with the in-house security team, RiverSafe got to grips with existing infrastructure, gathered requirements and outlined the desired outcomes of the project. With all challenges and end goals collated, the RiverSafe team developed a solution that would meet all requirements and eliminate current security weaknesses. The team suggested Exabeam’s Fusion SIEM platform as it addressed the key concerns: Incident management: Delivering streamlined incident management processes by automating the correlation and enrichment of security events, Fusion SIEM equips analysts with actionable insights and real-time alerts. This improved visibility helps analysts hone in on genuine threats more quickly and reduce response times. Behaviour analytics: Tackling the company’s lack of UEBA issue, Exabeam’s advanced machine learning algorithms were configured to establish baseline behaviour for all users and systems. Any deviation from this baseline alerts analysts, enabling them to investigate anomalous activities and potential security issues, including insider threats. Data integration: The platform was integrated with various data sources, including logs from firewalls, servers, applications, and network devices to ensure comprehensive visibility across the organization’s infrastructure. The outcome The implementation of Exabeam’s Fusion SIEM solution has yielded significant benefits, including: Enhanced threat detection: Exabeam’s behavioural analytics (AA) and machine learning (ML) capabilities have improved the accuracy of threat detection, enabling analysts to identify and respond to security incidents more effectively. Faster incident response: Exabeam’s automated incident enrichment and real-time alerts are helping the security team to respond to incidents promptly, minimizing the impact of potential breaches. Reduced alert fatigue: The platform’s next-generation event analysis capabilities have reduced the number of false positives generated, reducing alert fatigue and giving analysts more time to focus on genuine threats. Improved insider threat detection: With its advanced behaviour analytics, Fusion SIEM is enabling the team to detect insider threats by identifying abnormal user activities and deviations from established behavioural patterns.

Traditional security models protected a perimeter like a castle moat, assuming anyone inside was safe. Zero trust removes that implicit trust entirely, recognizing that threats can exist both outside and inside a facility. Zero trust is a routine and accepted concept in cybersecurity. Given the importance of information technology and the increasing convergence of physical and logical security, the tenet is becoming a dominant principle in physical security, too. We asked our Expert Panel Roundtable: Briefly define zero trust and explain how it impacts physical security.

In the world of cybersecurity, ethical hacking proactively identifies security vulnerabilities before malicious actors (i.e., unethical hackers) can exploit them. By simulating real-world attacks, organizations can strengthen defences, protect sensitive data, and maintain public trust. In the physical security world, ethical hacking can transform cybersecurity of security systems from a reactive struggle into a strategic safeguard. We asked our Expert Panel Roundtable: What is the role of ethical hacking as it relates to physical security?

The cloud fundamentally changes how organizations acquire and use technology, offering a powerful mix of financial, operational, and strategic advantages that traditional on-premises infrastructure cannot match. Specific to physical security systems, there are additional advantages transforming how technologies and systems are delivered to customers. We asked our Expert Panel Roundtable: Which factors are driving the deployment of cloud-based systems in physical security?