By: Cybersecurity & Infrastructure Security Agency

Today, CISA, in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and other international and U.S. partners, released new guidance for organizations seeking to procure Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms.

This guidance includes the following three resources:

• Implementing SIEM and SOAR Platforms – Executive Guidance outlines how executives can enhance their organization’s cybersecurity framework by implementing these technologies to improve visibility into network activities, enabling swift detection and response to cyber threats.
• Implementing SIEM and SOAR Platforms – Practitioner Guidance focuses on how practitioners can quickly identify and respond to potential cybersecurity threats and leverage these technologies to streamline incident response processes by automating predefined actions based on detected anomalies.
• Priority Logs for SIEM Ingestion – Practitioner Guidance offers insights for prioritizing log ingestion into a SIEM, ensuring that critical data sources are effectively collected and analyzed to enhance threat detection and incident response capabilities tailored for organizations.

CISA encourages organizations to review this guidance and implement the recommended best practices to strengthen their cybersecurity. For access to the guidance documents, please visit CISA’s SIEM and SOAR Resource page.

Photo credit: McKinsey & Company

By: Charlie Lewis, Ida Kristensen, and Jeffrey Caso with Julian Fuchs
McKinsey & Company

AI is transforming cybersecurity as both a major threat and a powerful defense. Cybercriminals are using AI to rapidly increase the speed and sophistication of attacks—often breaking through defenses in under an hour. Tools like deepfakes, AI-generated phishing, and malicious code injections help attackers craft personalized and convincing threats that evade traditional security systems. AI also enables real-time adaptation to targets’ defenses, making social engineering tactics like impersonation and spear phishing more effective and dangerous.

On the defensive side, AI empowers organizations to better detect, respond to, and recover from threats. It can analyze massive datasets in real time to spot anomalies, flag suspicious behavior, and even predict vulnerabilities before they are exploited. AI helps reverse-engineer malware, detect unusual login patterns, and automate routine cybersecurity tasks. This allows human teams to focus on more complex threats. Emerging “agentic AI” will further automate security operations by assisting with alert triage, investigation, and response. As AI advances, organizations must stay ahead by adopting AI-driven defenses to combat increasingly AI-powered cyberattacks.