Lumen Technologies expanded its managed security portfolio with Lumen Defender Advanced Managed Detection and Response (AMDR) for Palo Alto Networks Cortex XSIAM, combining Lumen’s network-based threat intelligence with Palo Alto Networks’ AI-driven security operations platform. The service targets enterprises seeking earlier threat detection, faster incident response, and reduced security operations complexity.
The offering integrates the Lumen Defender Threat Feed, powered by Black Lotus Labs, with Cortex XSIAM. Black Lotus Labs derives threat intelligence from activity observed across Lumen’s network infrastructure, providing visibility into attacker infrastructure, reconnaissance, staging activity, and other indicators that can emerge before attackers compromise enterprise systems. Lumen said the integration allows security teams to apply this network-level intelligence directly to automated detection, investigation, and response workflows.
Lumen Defender AMDR for Cortex XSIAM supports fully managed and co-managed security operations center models. The service uses automation, advanced analytics, and agentic workflows to consolidate security operations, reduce console switching, prioritize high-confidence alerts, accelerate incident triage, and provide additional context for investigations. The offering forms part of Lumen’s connected ecosystem strategy, which combines its fiber network, programmable infrastructure, security services, and technology partnerships.
• Integrates Lumen Defender Threat Feed intelligence from Black Lotus Labs with Palo Alto Networks Cortex XSIAM.
• Uses threat intelligence derived from activity observed across Lumen’s network infrastructure rather than relying exclusively on endpoint and log telemetry.
• Targets earlier detection of reconnaissance, attacker infrastructure, staging activity, and other pre-compromise indicators.
• Supports automated detection, investigation, threat scoping, triage, and response workflows.
• Provides both fully managed and co-managed SOC operating models.
• Uses alert grouping and contextual intelligence to reduce raw signal volume and prioritize higher-confidence security events.
• Incorporates agentic workflows to reduce repetitive security operations tasks and dependence on specialized in-house SOC resources.
• Expands the existing Lumen and Palo Alto Networks partnership as part of Lumen’s connected ecosystem strategy.
“Cyber defense is a speed game, and the network is where threats often show up first,” said Jim Fowler, Chief Technology and Product Officer at Lumen. “With Palo Alto Networks, we’re again raising the bar for security by expanding access to our high-value network threat intelligence and putting it to work through modern, automated operations. As we bring Lumen Defender AMDR to more partners and platforms, more customers can quickly thwart bad actors.”
🌐 Analysis: The integration reflects a broader shift toward combining security telemetry from endpoints, cloud platforms, applications, and network infrastructure within automated SOC architectures. Lumen’s ability to derive threat intelligence from its global network gives Black Lotus Labs a distinct telemetry source, while Cortex XSIAM provides the analytics, automation, and incident-response layer needed to operationalize that intelligence across enterprise security environments.
The partnership also illustrates how network operators increasingly position network-derived security intelligence as a complementary input to AI-driven security platforms. As enterprises consolidate security tools and deploy more automated SOC workflows, the competitive focus is shifting toward the quality of telemetry, speed of threat detection, integration of threat context, and the ability to execute response actions across distributed infrastructure.
