Cato XOps: from alert to action

OP-ED · 12 SEPTEMBER 2025

By Jérôme Beaufils, CEO of SASETY · Lire en français

The constant noise of alerts

In today's environments, every cybersecurity and connectivity component continuously produces its own alerts.

Intrusion prevention, endpoint protection, cloud application access control, data loss prevention and IoT security all multiply security alerts.

On the network side, equipment handling data transport, access links and QoS management adds its own events too.

Most of this data is redundant, insufficiently contextualised and impossible to process manually at scale.

This overload is the main cause of fatigue among IT teams and creates operational inefficiency.

XDR and AIOps converging in a single engine

Cato XOps from Cato Networks was designed as an artificial intelligence layer built into SASE.

Technically, it is an analytics engine that merges two activities:

XDR(Extended Detection and Response), which correlates and enriches security events
AIOps (Artificial Intelligence for IT Operations), which automates the detection and resolution of network incidents

Unlike traditional XDR platforms that require integrating multiple third-party sensors, XOps natively benefits from all the sensors of the Cato SASE platform.

Every security and network service is directly connected to the AI engine. This removes fragile integrations and guarantees end-to-end correlation.

From raw data to an actionable “story”

Functionally, XOps applies several processing layers.

Event streams are first normalised, then correlated to identify attack sequences or abnormal behaviour.

Next, a machine learning engine performs predictive analysis, looks for similarities with past incidents and ranks criticality.

Finally, a natural language generation (GenAI) layer produces an easy-to-understand summary in the form of a “story”.

Each story is structured with a title, a contextual summary, the associated MITRE ATT&CK technique, the evidence collected and a remediation recommendation.

This format allows an analyst to go straight from detection to investigation, without having to go through thousands of logs.

A unified operational approach

For IT teams, the benefit is immediate: network and security functions now work together in an integrated, collaborative way rather than in silos.

The single interface of the Cato Management Application shows network and security incidents in the same feed, making it possible, for example, to quickly identify whether an application slowdown is caused by bandwidth saturation or a DDoS attack.

Access to granular network data and threat intelligence makes it possible to confirm or rule out a hypothesis in a few clicks.

This unification reduces Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), two critical cyber defence indicators.

It also simplifies governance, since the reports generated by XOps include both security indicators and network performance indicators.

Towards a new generation of security and network operations

XOps has become the true analytics engine of the Cato Networks SASE platform.

Thanks to multi-layer correlation, predictive AI, MITRE contextualisation and automated summary generation, it turns a mass of heterogeneous events into clear, directly actionable information.

For CISOs and infrastructure managers, this means a stronger security posture, smoother network operations and a tangible reduction in TCO.

By unifying XDR and AIOps in an integrated approach, Cato XOps sets a new benchmark for IT and security operations.

XOps x SASETY: from tailored deployment to continuous remediation

Cato XOps gives organisations unified operational intelligence, and SASETY's support brings out its full value by making it possible to exploit its potential fully.

Through its XOps approach, SASETY designs and deploys tailored architectures, adapted to the context and constraints of each client.

This commitment continues over time through its Managed Detection & Response (MDR) services, which provide continuous monitoring, proactive alert management and effective remediation.

This combination of cutting-edge technology and day-to-day operational support guarantees stronger security and smooth operations, while significantly reducing complexity and costs.

☎️ A question, a project? Our experts are here to help!

Contact our experts →