Two pillars of cluster state—both protected

The incremental index: Your scan memory

High Speed Discovery's Incremental mode builds an index of every file scanned—what was found and when. This is what makes subsequent scans focus only on changed content instead of re-inspecting the entire repository.

Before HDR support, that index lived solely on the data node. A hardware failure erased it, forcing every subsequent scan to restart from scratch. The incremental-index-backup command (Symantec DLP 25.1) captures the index as a timestamped zip file; incremental-index-restore brings it back to a new data node so the next scan resumes as incremental. Not a cold restart.

ART History: Your remediation intelligence

Automatic Remediation Tracking (ART) accumulates its intelligence over successive scan cycles, comparing current findings against prior incidents to determine whether a violation is still active, a file was modified, or a policy change resolved the issue.

Losing that history to a data node failure doesn't just inconvenience your team. It actively breaks ART. Previously resolved incidents can re-open; files already evaluated appear fresh to the engine. The art-backup command (Symantec DLP 26.1) protects this history, and art-restore brings it back coherent and continuous to the new data node.

A single command for both

The backup-all and restore-all commands Symantec DLP 26.1 give administrators a single operation that covers both: one zip file, one restore command, and a complete cluster state is recovered. No sequencing, no risk of restoring one without the other.

9a:T61f,

How the recovery process works

The full recovery sequence is documented in the Symantec DLP Help Center. But in practice, it can be summarized to three phases:

Before the disaster: Establish a backup routine. Run backup-all periodically from the data node, storing the output zip on storage outside the data node server. The frequency you choose determines how much work might need to be repeated after recovery.
When disaster strikes: Install one server, reconnect the rest. Install the data node software on a new server. Update the cluster IP in the Enforce console if needed (all policies and profiles re-sync automatically). Then run update-cluster-details on each worker node. This single command re-associates the worker node with the new data node—no reinstallation required.
After the disaster: Restore and resume. Run restore-all pointing at the backup zip. Once complete, run your existing scan targets unchanged. The cluster resumes from its last backup checkpoint.

9b:T487,

Built for recovery with zero disruptions

Disaster recovery shouldn’t create new problems while it’s solving existing ones. That’s why the Cluster Admin Tool is deliberately designed for safe production use. This tool:

☑️ Respects active scans. Backup and restore skip targets that are actively scanning, rather than interfering. Results are reported per-target in the backup manifest.

☑️ Protects in-progress operations. If a backup or restore is running for a target and a scan is triggered for that same target, the scan simply queues and waits. A Walk activity log entry explains exactly what’s happening.

☑️ Survives its own crashes. If the tool or the Detector process restarts mid-operation, the operation continues to completion on the data node. The tool reports the results the next time it’s launched.

☑️ Gives you visibility. The get-pending-command command reports the status of any in-progress operation — no black boxes during recovery.

9c:T502,

Picking up where you left off

We know how much time goes into building and maintaining a resilient discovery program. That’s why disaster recovery isn’t just about getting a cluster back online. It’s about protecting the work your team has already accomplished.

If you’re using Incremental Scan, disaster recovery support protects every investment your program has made in scan efficiency. Instead of starting from scratch after a data node failure, you can pick up right where your last backup left off. The same is true for ART. Support is not optional, but a prerequisite for reliable ART operation. Without it, a single outage resets the incident history that ART's classifications depend on.

These benefits also extend beyond day-to-day operations. Compliance teams won’t have to worry that a data node failure will derail scheduled scan cycles, with recovery measured in command executions rather than business days.

For operations teams, planned maintenance windows no longer need to be scheduled around active scan cycles. They can take the data node offline, restore when back, and resume scanning—all without touching a single scan target configuration.

9d:T42b,

Don’t just recover, resume

Disaster Recovery support is available now in Symantec DLP 25.1 with Incremental Index backup and restore, and expanded in Symantec DLP 26.1 to include ART backup and restore with backup-all and restore-all commands. Best of all, the Cluster Admin Tool ships as a standalone package, making it easier than ever to add these capabilities without modifying your existing installation.

For a complete breakdown of command syntax, parameters, prerequisites, and a step-by-step configuration, see the Network Discover Cluster Admin Tool documentation.

Not yet running High Speed Discovery? Reach out to your in-region expert for a 1:1 demo.

9e:T44b,

Great data, 0/10 user experience

Privileged Access Management (PAM) is one of the most data-rich systems in your security infrastructure. It knows who accessed what, when, where, and for how long. It holds your access policies, your privileged account inventory, your session history, your license utilization, and your compliance posture—all in one place.

Yet for most organizations, actually getting data out of that system is a friction-filled exercise. Compliance officers submit requests to administrators. Administrators build queries or custom scripts. Reports get generated, formatted, emailed, and by the time they land in an inbox, the underlying data has already changed. Next quarter, the request changes. The old script no longer fits and someone’s forced to build a new one.

This is not a technology failure. It is an interface failure. The data is there. The problem is that the only way to access it has been through static dashboards, scheduled reports, or bespoke scripts written by engineers with many other priorities.

9f:T77a,

How MCP bridges AI and PAM

The Model Context Protocol (MCP) is an open standard that allows AI models to connect directly to external systems through a structured set of tools. Think of it as a universal translator: your AI model asks a plain language question, the MCP server translates it into precise API calls against your PAM system, then returns structured data the model can summarize and explain in seconds.

By leveraging Symantec PAM's REST API through an MCP integration, every tool defined becomes available through your LLM and natural language. A compliance officer doesn’t need to know what endpoint returns session logs, nor does a manager need to understand how access policies are structured in the database. They simply ask—and a clear answer comes back.

4 ways AI makes PAM more useful

From static reports to live answers

Instead of a fixed weekly report, stakeholders ask freeform questions and receive accurate answers drawn directly from live PAM data—no intermediary, ticket queue, or wait.

From custom scripts to flexible reporting

When reporting requirements change (they always do)there is no script to rewrite. The AI model adapts to the new question immediately, combining multiple data sources in a single response without any engineering work

From siloed data to synthesized insight

A single AI query can span users, groups, access policies, session history, and device inventories while correlating information that would ordinarily require multiple reports and manual reconciliation.

From reactive reviews to continuous visibility

Rather than waiting for a compliance cycle to surface issues, an AI-backed system can surface anomalies, policy gaps, and license trends as they emerge, whether on a schedule or on demand.

a0:T9c0,

Agents that keep every team informed—without anyone asking

The real multiplier of this architecture is not the individual query, but the autonomous agent. An AI agent connected to your PAM system through MCP can be configured to run independently on a schedule, analyze what it finds, and push structured summaries to the stakeholders who need them.

Now imagine what happens when the AI stops waiting for someone to ask. Your security operations team wakes up to a summary of overnight session activity and any anomalies in access patterns. Your compliance team receives a weekly digest of policy changes, new privileged accounts, and any accounts that have not been accessed in 90 days. Your executive team gets a monthly license utilization and access governance snapshot—formatted for their level of detail, not a security engineer's.

All of this flows from the same MCP integration. No additional tooling, custom reporting pipelines, or dedicated reporting staff. The agent reads the data, synthesizes what matters, and routes the right information to the right people. Once it’s in place, answering the next question (or serving the next stakeholder) requires little additional effort yet its value only continues to grow.

What an autonomous PAM agent looks like in practice:

Nightly: Query all active sessions and failed login attempts; flag accounts with unusual access hours or repeated failures; push summary to the security operations channel.
Weekly: Enumerate all users and their role-to-privilege mappings; identify accounts holding more than one high-privilege role; deliver a least-privilege compliance digest to the identity governance team.
On-demand: Respond to ad-hoc queries from auditors during a compliance review—pulling session logs, access policy details, and account histories in seconds rather than days.
Event-driven: Triggered by a new access policy or account creation, automatically summarize the change and its downstream impact across affected device groups and user assignments.

a1:T658,

Start with read-only access

Everything described in this article is read-only. The MCP tools covered query, retrieve, summarize, and surface data from Symantec PAM. They do not create users, modify policies, provision accounts, or terminate sessions, all of which is intentional.

Read-only AI integrations carry a fundamentally different risk profile than write-capable ones. The worst outcome of a misconfigured read query is a confusing or incomplete response. Because the data in your PAM system remains unchanged, a read-only integration is the best natural starting point. Not only does it deliver value from the get-go, it’s safe to deploy, and helps organizations quickly build confidence and familiarity with AI-driven operations before introducing any write capabilities.

This is how mature organizations approach AI adoption in sensitive systems: establish the value and the patterns first, then expand the surface area deliberately.

The road to write actions

Write capabilities, like provisioning accounts, modifying policies, terminating sessions, rotating credentials, represent a major expansion of what an AI agent can affect in your environment. Rather than a reason to avoid them, it’s why they should be approached with the same rigor applied to any privileged operation: appropriate guardrails, human approval workflows, audit logging of AI-initiated changes—including carefully defining what any given agent is permitted. We’ll be exploring just that in a future installment of this series.

a2:T810,

The best time to get AI-ready is now

The question most organizations face today is not whether AI will become a meaningful part of their security and compliance operations—it is whether their current infrastructure is positioned to take advantage of it when that moment arrives.

MCP-enabling your PAM system is a low-risk, high-leverage step toward that readiness. Rather than betting on a specific AI model or vendor, MCP offers a model-agnostic approach. The same server works with Claude, GPT, or any open-source model your organization chooses to deploy. There’s no need to rebuild your PAM infrastructure or commit to any particular workflow. The MCP layer sits right alongside your existing deployment, available to AI models when they need—through an analyst's conversation, an automated agent, even a future integration you haven't yet envisioned.

What you are doing is making your identity security data accessible in the way that AI systems are designed to consume it. Every organization that does this work now will be significantly ahead of those that wait for a specific use case to force the issue.

3 advantages of an AI-ready PAM approach

Low risk deployment. The MCP layer sits alongside your existing PAM deployment without changing the appliance, policies, or configurations.
Future flexibility. Because MCP is an open standard, it works with any AI model your organization chooses—whether on the cloud, on-premise, or open-source—without rearchitecting the integration.
Compounding returns. Value grows with every new stakeholder, data request or AI agent built on the same integration, practically lowering the marginal cost of the next to zero.

a3:T762,

Unlock your PAM with AI

Privileged access data has always been critical to security, compliance, and governance. The barrier has never been whether the data exists (it always has) but whether organizations could surface it efficiently enough to act. AI models connected through MCP remove that barrier entirely.

Compliance officers get answers without tickets.
Security teams get synthesized summaries without scripts.
Executives get the visibility they need without pulling engineers away from higher-value work.
Autonomous agents keep all of those parties informed continuously, without anyone having to ask.

This is what it means to be AI-ready in identity security. Not replacing your PAM platform, but unlocking the value of everything it already knows. As AI becomes a bigger part of security operations, organizations that make their identity data AI-accessible today will be better positioned for whatever comes next.

For further discussion or to see a solution like this in action, reach out to your Broadcom Business, Strategic, or Partner Advisor.

Up next

Future episodes will cover write-capable MCP tools, like automated account provisioning, policy management, and session control, along with the governance frameworks, approval workflows, and audit requirements that responsible, AI-driven write operations demand. We will also examine how autonomous agents can be scoped, constrained, and monitored when they are given the ability to act, not just observe.

a4:T12ed,

1. Modern attacks are built in stages

Today's threats rarely consist of a single event. Attackers establish access, move laterally, escalate privileges, and target data over time—making it critical to connect activity across the entire attack chain. Looking at one alert in isolation rarely explains the full scope of an incident. Native telemetry correlation helps security teams understand how individual events fit together, making investigations faster and more complete.

2. No single signal can explain a modern attack

Endpoint, network, cloud, and data security telemetry each tell part of the story. Correlation brings those pieces together, revealing where an attack has moved, what systems were affected, and its potential impact. Instead of manually piecing together evidence across multiple tools, analysts can investigate with the full picture from the jump.

3. The time to respond keeps shrinking

Attackers are moving faster than ever, leaving security teams with less time to investigate and contain threats. Every minute spent switching between consoles or chasing disconnected alerts gives attackers more opportunity to move deeper into the environment. Faster response starts with faster context.

4. Machine-speed threats require machine-speed insights

AI and automation are helping attackers scale campaigns, accelerate reconnaissance, and move through environments more quickly than ever before. Defenders need equally efficient ways to connect, understand, and respond to malicious activity. Correlating telemetry automatically helps teams keep pace without adding more manual work to already overloaded SOCs.

5. Security through obscurity doesn't work anymore

Enterprise-grade attacks aren't reserved for the 1 percent. Organizations of every size are facing sophisticated threats and need controls that can keep up. Whether you're defending hundreds of users or hundreds of thousands, attackers don't scale back their tactics. Visibility across the full attack chain has become a necessity—not a luxury.

6. Security teams are being asked to do more with less

Threats keep growing, but most security teams aren't. Intelligent Correlation helps analysts cut through noise, reduce manual effort, and spend more time responding to the threats that matter most. That means less time chasing context and more time containing threats.

7. More tools create more complexity

Years of adding point products to existing stacks have left organizations juggling multiple consoles, dashboards, and disconnected data sources. More visibility shouldn't mean more work. Correlating activity across domains reduces context switching and helps analysts spend less time stitching together investigations and more time responding to them.

8. Analysts need answers, not more integration work

Already-strapped security teams shouldn't have to spend valuable time stitching together alerts and logs using APIs just to understand what's happening. A quality XDR platform should have built-in correlation that eliminates bolted-on integrations and surfaces meaningful context automatically.

9. Data without context is just noise

Organizations aren't struggling to collect telemetry. They're struggling to make sense of it at machine speed. Intelligent Correlation transforms isolated signals into a coherent attack story, helping analysts distinguish routine activity from behavior that requires immediate action.

10. Fewer blind spots lead to faster remediation

Bringing endpoint, network, and data telemetry together creates a comprehensive view of attacker activity, helping teams investigate and respond with speed and confidence. Better visibility also makes it easier to understand the true scope of an incident, reducing the risk of overlooking compromised systems or affected data.

11. Advanced security outcomes depend on native telemetry correlation

AI-powered capabilities like Threat Tracer (which visualizes the entire attack chain), Adaptive Protection (which stops LOTL attacks before they can begin), Incident Prediction (which anticipates an attacker’s next four or five moves), AI-Generated Incident Summaries (that connect the dots and provide guidance for next steps), and automated response become significantly more effective when powered by correlated signals across the environment. Native telemetry correlation provides the shared context these capabilities rely on, helping security teams move from isolated alerts to connected investigations.

a5:T7dc,

Native telemetry correlation: The future of XDR

Every investigation depends on context. Native telemetry correlation provides it.

That’s the approach behind Symantec CBX. By natively correlating signals across endpoint, network, and data, CBX gives security teams a connected view of any attack—helping them investigate with confidence, reduce manual effort, and respond before attacks escalate.

Ready to stop collecting signals and start connecting them? Connect with your in-region experts to see what CBX can do for your team.

Want to learn more about native telemetry correlation? Read on.

How is native telemetry correlation different from traditional security integrations?

Traditional security integrations often rely on APIs to share data between separate tools, requiring analysts to manually connect related events. Native telemetry correlation brings signals together by design, creating a more complete and timely view of attacker activity without relying on disconnected workflows.

What types of telemetry should an XDR platform correlate?

An effective XDR platform should correlate telemetry across endpoints, networks, cloud environments, identities, and data. Bringing these signals together helps security teams understand how an attack unfolds, identify relationships between events, and investigate incidents with greater speed and accuracy.

Why is native telemetry correlation important for AI-powered security?

AI is only as effective as the data it analyzes. Native telemetry correlation provides AI-driven security capabilities with richer context by connecting related activity across the environment, helping improve threat detection, investigation, prioritization, and automated response.

a6:T426,

Today’s cyber threats are fueled by more: More ransomware. More attacks leveraging native tools for lethal LOTL. More remote storage pillaging and data exfiltration. More malicious co-opting of third-party tools. More supply chain attacks.

And, with all this happening at machine speed, the cost of staying ahead continues to increase, especially for SOC teams with lean resources or for those relatively new to the battlefield.

Amid this onslaught, CBX Fest’s June webinar, The Entry Point to Enterprise-Grade Web Security, delivers some good news: Symantec CBX’s web security is ready for the challenge with native telemetry correlation and intuitive features that help security teams see more, stop more and respond faster, even for entry-level teams.

a7:T5ee,

Questioning a detection-centered mindset

Many organizations still use EDR mainly for behavioral analysis aimed at detection. Detection is no joke. And the endpoint security foundation of CBX, Symantec Endpoint Security (SES) Complete, takes itself seriously, recently earning a perfect detection score in AV-TEST’s rigorous evaluations. But, that’s not the whole picture.

A detection-centric model can make more work for your SOC. When they catch a malicious application in time to mitigate damage, they still have to answer a lot of questions:

● Was this a legit app that was simply not performing well?

● Was it a legit app that has now been compromised?

● How long has the app been on the machine?

● What did it do before it exhibited bad behavior?

● Did it modify confidential data or compromise data integrity?

● Did it exfiltrate anything?

Answering these questions takes time. And for over-burdened or less-experienced teams, every minute spent investigating is time attackers can use to move deeper into your environment. That’s where stopping more at the web layer can change the story.

a8:T485,

Stop threats at the web layer

In a threat landscape where attacks are certain, an ounce of prevention is worth a pound of detection.

CBX’s natively correlated visibility reveals activity across endpoints, web traffic, and data, giving analysts greater context into what happened before and during an attack. But visibility at the web layer also creates opportunities to stop threats earlier. Because CBX sees the whole attack field and delivers intel at machine speed, it gets ahead of the timeline and lowers Mean Time to Prevent (MTTP). Attackers hit fast, but CBX blocks faster, stopping attacks at the web layer before they ever get to the box and eliminating the post-attack interrogation.

Like numbers? Customers deploying this technology stack see more than 90% of attacks blocked before they reach the endpoint, easing the burden on SOC teams.

a9:T456,

Curated policies for your inner control freak

CBX consolidates intelligence and drives policy tuning, making it easy to tailor web security to your organization’s needs. Its easily-digestible insights offer clear direction on preventable risks, while its intuitive console makes policy tuning a breeze.

Visibility and machine speed are the not-so-secret sauce behind it all. When CBX’s native telemetry gives a full view of your whole enterprise across domains, with analysis digested and delivered quickly and clearly, you get actionable insights that your team can trust. Combined with AI-powered summaries and guided investigations, CBX helps analysts of every experience level work faster (with less manual effort). With CBX, they can customize their organization’s policies for maximized protection with confidence and clarity across networks, endpoints, and data.

aa:T553,

Seeing is believing

If this sounds too good to be true, watch the CBX Fest session for yourself. CBX delivers a single-pane view, run by a single agent and unified console that makes web visibility, prevention, and customized policy tuning intuitive—without the need of toggling between screens or devices.

Unlike vendors who dress up hopes, dreams, and a couple of APIs and call it integration, CBX is the real deal. No matter where the data is, no matter where the users are, everything goes through the same simplified security stack, so it gets a comprehensive, seamless web traffic inspection, CASB controls, and a host of other built-in checkpoints. Network protection goes even further with web categorization, filtering, and sensitive data scanning to block web-based threats before they reach the browser.

It’s shoes off, check pockets for receipts style security that gives risky web activity a serious checkpoint before it can reach the endpoint.

ab:T44b,

Great data, 0/10 user experience

Privileged Access Management (PAM) is one of the most data-rich systems in your security infrastructure. It knows who accessed what, when, where, and for how long. It holds your access policies, your privileged account inventory, your session history, your license utilization, and your compliance posture—all in one place.

Yet for most organizations, actually getting data out of that system is a friction-filled exercise. Compliance officers submit requests to administrators. Administrators build queries or custom scripts. Reports get generated, formatted, emailed, and by the time they land in an inbox, the underlying data has already changed. Next quarter, the request changes. The old script no longer fits and someone’s forced to build a new one.

This is not a technology failure. It is an interface failure. The data is there. The problem is that the only way to access it has been through static dashboards, scheduled reports, or bespoke scripts written by engineers with many other priorities.

ac:T77a,

How MCP bridges AI and PAM

The Model Context Protocol (MCP) is an open standard that allows AI models to connect directly to external systems through a structured set of tools. Think of it as a universal translator: your AI model asks a plain language question, the MCP server translates it into precise API calls against your PAM system, then returns structured data the model can summarize and explain in seconds.

By leveraging Symantec PAM's REST API through an MCP integration, every tool defined becomes available through your LLM and natural language. A compliance officer doesn’t need to know what endpoint returns session logs, nor does a manager need to understand how access policies are structured in the database. They simply ask—and a clear answer comes back.

4 ways AI makes PAM more useful

From static reports to live answers

Instead of a fixed weekly report, stakeholders ask freeform questions and receive accurate answers drawn directly from live PAM data—no intermediary, ticket queue, or wait.

From custom scripts to flexible reporting

When reporting requirements change (they always do)there is no script to rewrite. The AI model adapts to the new question immediately, combining multiple data sources in a single response without any engineering work

From siloed data to synthesized insight

A single AI query can span users, groups, access policies, session history, and device inventories while correlating information that would ordinarily require multiple reports and manual reconciliation.

From reactive reviews to continuous visibility

Rather than waiting for a compliance cycle to surface issues, an AI-backed system can surface anomalies, policy gaps, and license trends as they emerge, whether on a schedule or on demand.

ad:T9c0,

Agents that keep every team informed—without anyone asking

The real multiplier of this architecture is not the individual query, but the autonomous agent. An AI agent connected to your PAM system through MCP can be configured to run independently on a schedule, analyze what it finds, and push structured summaries to the stakeholders who need them.

Now imagine what happens when the AI stops waiting for someone to ask. Your security operations team wakes up to a summary of overnight session activity and any anomalies in access patterns. Your compliance team receives a weekly digest of policy changes, new privileged accounts, and any accounts that have not been accessed in 90 days. Your executive team gets a monthly license utilization and access governance snapshot—formatted for their level of detail, not a security engineer's.

All of this flows from the same MCP integration. No additional tooling, custom reporting pipelines, or dedicated reporting staff. The agent reads the data, synthesizes what matters, and routes the right information to the right people. Once it’s in place, answering the next question (or serving the next stakeholder) requires little additional effort yet its value only continues to grow.

What an autonomous PAM agent looks like in practice:

Nightly: Query all active sessions and failed login attempts; flag accounts with unusual access hours or repeated failures; push summary to the security operations channel.
Weekly: Enumerate all users and their role-to-privilege mappings; identify accounts holding more than one high-privilege role; deliver a least-privilege compliance digest to the identity governance team.
On-demand: Respond to ad-hoc queries from auditors during a compliance review—pulling session logs, access policy details, and account histories in seconds rather than days.
Event-driven: Triggered by a new access policy or account creation, automatically summarize the change and its downstream impact across affected device groups and user assignments.

ae:T658,

Start with read-only access

Everything described in this article is read-only. The MCP tools covered query, retrieve, summarize, and surface data from Symantec PAM. They do not create users, modify policies, provision accounts, or terminate sessions, all of which is intentional.

Read-only AI integrations carry a fundamentally different risk profile than write-capable ones. The worst outcome of a misconfigured read query is a confusing or incomplete response. Because the data in your PAM system remains unchanged, a read-only integration is the best natural starting point. Not only does it deliver value from the get-go, it’s safe to deploy, and helps organizations quickly build confidence and familiarity with AI-driven operations before introducing any write capabilities.

This is how mature organizations approach AI adoption in sensitive systems: establish the value and the patterns first, then expand the surface area deliberately.

The road to write actions

Write capabilities, like provisioning accounts, modifying policies, terminating sessions, rotating credentials, represent a major expansion of what an AI agent can affect in your environment. Rather than a reason to avoid them, it’s why they should be approached with the same rigor applied to any privileged operation: appropriate guardrails, human approval workflows, audit logging of AI-initiated changes—including carefully defining what any given agent is permitted. We’ll be exploring just that in a future installment of this series.

af:T810,

The best time to get AI-ready is now

The question most organizations face today is not whether AI will become a meaningful part of their security and compliance operations—it is whether their current infrastructure is positioned to take advantage of it when that moment arrives.

MCP-enabling your PAM system is a low-risk, high-leverage step toward that readiness. Rather than betting on a specific AI model or vendor, MCP offers a model-agnostic approach. The same server works with Claude, GPT, or any open-source model your organization chooses to deploy. There’s no need to rebuild your PAM infrastructure or commit to any particular workflow. The MCP layer sits right alongside your existing deployment, available to AI models when they need—through an analyst's conversation, an automated agent, even a future integration you haven't yet envisioned.

What you are doing is making your identity security data accessible in the way that AI systems are designed to consume it. Every organization that does this work now will be significantly ahead of those that wait for a specific use case to force the issue.

3 advantages of an AI-ready PAM approach

Low risk deployment. The MCP layer sits alongside your existing PAM deployment without changing the appliance, policies, or configurations.
Future flexibility. Because MCP is an open standard, it works with any AI model your organization chooses—whether on the cloud, on-premise, or open-source—without rearchitecting the integration.
Compounding returns. Value grows with every new stakeholder, data request or AI agent built on the same integration, practically lowering the marginal cost of the next to zero.

b0:T762,

Unlock your PAM with AI

Privileged access data has always been critical to security, compliance, and governance. The barrier has never been whether the data exists (it always has) but whether organizations could surface it efficiently enough to act. AI models connected through MCP remove that barrier entirely.

Compliance officers get answers without tickets.
Security teams get synthesized summaries without scripts.
Executives get the visibility they need without pulling engineers away from higher-value work.
Autonomous agents keep all of those parties informed continuously, without anyone having to ask.

This is what it means to be AI-ready in identity security. Not replacing your PAM platform, but unlocking the value of everything it already knows. As AI becomes a bigger part of security operations, organizations that make their identity data AI-accessible today will be better positioned for whatever comes next.

For further discussion or to see a solution like this in action, reach out to your Broadcom Business, Strategic, or Partner Advisor.

Up next

Future episodes will cover write-capable MCP tools, like automated account provisioning, policy management, and session control, along with the governance frameworks, approval workflows, and audit requirements that responsible, AI-driven write operations demand. We will also examine how autonomous agents can be scoped, constrained, and monitored when they are given the ability to act, not just observe.

b1:T225c,

1. Cross-domain threat detection & response

Traditional and siloed security tools are missing those increasingly common multi-vector attacks because they only see one piece of the puzzle. CBX connects the dots and uncovers the full campaign. CBX excels at:

Correlating low-confidence alerts. An attacker deploys a low-level phishing email, a minor credential anomaly on a server, and a strange outbound network connection. Individually, these look like harmless background noise. CBX stitches them together and delivers a single, high-confidence alert showing a well-coordinated attack.
Detecting lateral movement. Once inside a network, attackers try to move from machine to machine undetected. CBX tracks users, network logs, and endpoint behaviors simultaneously to flag when an account is moving across the environment in an abnormal manner. CBX raises the alert and shuts down even stealthy attacks.

2. Automated attack disruption

Manual triage takes too long when ransomware is spreading at machine speed. CBX utilizes attack-trained AI to predict an attacker's next steps with confidence and stop them in real time while an investigation is ongoing. Here’s how automation eases the burden on the SOC team:

Automated containment. When CBX detects a ransomware strain or a data exfiltration attempt, it can instantly isolate the endpoint, block the malicious IP at the firewall, and disable the compromised user account—all without waiting for a human analyst to wake up.
Cross-domain cleanups. If a malicious file is found on one user's laptop, CBX can automatically scan all other endpoints, find the other instances of the malicious file and remove it organization-wide. That automated cleanup clears time for more important tasks.

3. Accelerated investigations & root-cause analysis

At today’s attack rate and intensity, speed is king. When a breach occurs, analysts usually spend hours digging through different consoles to figure out what happened. CBX replaces digging with an intuitive investigation workflow and attack visualization. Here’s how CBX delivers clear context that even a less experienced team member can understand and act on:

Attack timelines. CBX reconstructs the entire lifecycle of an attack into a graphical "storyline" or timeline using Threat Tracer. Analysts can instantly see how the attacker got in, what files they changed, what data they touched, and how far they managed to infiltrate the larger ecosystem.
Reducing alert fatigue. By grouping hundreds of raw logs and isolated alerts into a single fully contextualized alert that can directly trigger an investigation, CBX significantly reduces the noise that SOC analysts have to sift through, drastically lowering the mean time to respond (MTTR).

4. Proactive threat hunting

Instead of waiting for an alert to pop up, security teams use CBX to hunt for hidden threats and harden against emerging threats. CBX ditches the passive prey model to become the ultimate cyberthreat predator with:

Broad queries across the data repository. Run a single query to search for indicators of compromise (IoCs), such as a specific registry change or a malicious hash, across the environment. CBX keeps record with a finger on the pulse so security analysts don’t have to.
Behavioral baselines. CBX uses machine learning to understand what "normal" looks like for your specific organization. Using those baselines, organizations can easily customize Adaptive Protection policies so that abnormal behavior for different users, devices and applications is immediately flagged for further investigation. This capability greatly reduces an attacker's ability to live off the land without identification. As baselines change, your protection adapts.

5. Insider threat & compromised account identification

Threats don't always come from the outside. Insider threats—malicious users, human error, or legitimate accounts hijacked via credential stuffing—can be just as debilitating. Here’s how CBX spots traitors in your midst:

User and entity behavior analytics. CBX monitors data access patterns. If a standard employee suddenly logs in from an unusual geographic location at 3:00 AM and attempts to download massive amounts of intellectual property from a cloud repository, CBX flags the account as compromised or rogue. CBX works 24/7/365 so analysts can get to work well-rested and battle-ready.

6. Comprehensive protection against modern attacks

Strong prevention is the foundational layer that makes detection and response sustainable. Relying solely on detection and response creates a reactive posture where security teams are stuck playing catch-up against threats out of their league. CBX’s strong prevention capabilities drive down the overall volume of alerts, and in effect those that require deeper human investigation. Its proactive prevention stacks up with:

Multi-layered prevention. CBX combines Adaptive Protection, Firewall, Device Control, foundational static and behavioral prevention (and more) to deliver key endpoint protection against sophisticated modern attacks.
Reduced burden on endpoints. CBX delivers native web security capabilities to deflect malicious traffic before it reaches endpoints, reducing reliance on prevention controls at the endpoint alone. With built-in visibility into user browsing and acceptable use policy enforcement, CBX’s web security capabilities boost overall security posture.
AI/ML-enhanced protection. CBX leverages AI/ML models so CBX protection hits at machine speed. CBX uses advanced models to adapt protection policies, predict an attacker's next moves, and to identify hidden patterns that could indicate a stealthy attack.

All six use cases add up to an XDR that actually eases the burden on the hard-working analysts at the helm. CBX sees around corners, questions everything, and makes sense of the chaos so that your environment feels calm and comprehensively protected.

To see how CBX handles even the most complex use cases with ease, check out the solution brief. Or better yet, test drive it live with a 1:1 demo.

b2:T426,

Today’s cyber threats are fueled by more: More ransomware. More attacks leveraging native tools for lethal LOTL. More remote storage pillaging and data exfiltration. More malicious co-opting of third-party tools. More supply chain attacks.

And, with all this happening at machine speed, the cost of staying ahead continues to increase, especially for SOC teams with lean resources or for those relatively new to the battlefield.

Amid this onslaught, CBX Fest’s June webinar, The Entry Point to Enterprise-Grade Web Security, delivers some good news: Symantec CBX’s web security is ready for the challenge with native telemetry correlation and intuitive features that help security teams see more, stop more and respond faster, even for entry-level teams.

b3:T5ee,

Questioning a detection-centered mindset

Many organizations still use EDR mainly for behavioral analysis aimed at detection. Detection is no joke. And the endpoint security foundation of CBX, Symantec Endpoint Security (SES) Complete, takes itself seriously, recently earning a perfect detection score in AV-TEST’s rigorous evaluations. But, that’s not the whole picture.

A detection-centric model can make more work for your SOC. When they catch a malicious application in time to mitigate damage, they still have to answer a lot of questions:

● Was this a legit app that was simply not performing well?

● Was it a legit app that has now been compromised?

● How long has the app been on the machine?

● What did it do before it exhibited bad behavior?

● Did it modify confidential data or compromise data integrity?

● Did it exfiltrate anything?

Answering these questions takes time. And for over-burdened or less-experienced teams, every minute spent investigating is time attackers can use to move deeper into your environment. That’s where stopping more at the web layer can change the story.

b4:T485,

Stop threats at the web layer

In a threat landscape where attacks are certain, an ounce of prevention is worth a pound of detection.

CBX’s natively correlated visibility reveals activity across endpoints, web traffic, and data, giving analysts greater context into what happened before and during an attack. But visibility at the web layer also creates opportunities to stop threats earlier. Because CBX sees the whole attack field and delivers intel at machine speed, it gets ahead of the timeline and lowers Mean Time to Prevent (MTTP). Attackers hit fast, but CBX blocks faster, stopping attacks at the web layer before they ever get to the box and eliminating the post-attack interrogation.

Like numbers? Customers deploying this technology stack see more than 90% of attacks blocked before they reach the endpoint, easing the burden on SOC teams.

b5:T456,

Curated policies for your inner control freak

CBX consolidates intelligence and drives policy tuning, making it easy to tailor web security to your organization’s needs. Its easily-digestible insights offer clear direction on preventable risks, while its intuitive console makes policy tuning a breeze.

Visibility and machine speed are the not-so-secret sauce behind it all. When CBX’s native telemetry gives a full view of your whole enterprise across domains, with analysis digested and delivered quickly and clearly, you get actionable insights that your team can trust. Combined with AI-powered summaries and guided investigations, CBX helps analysts of every experience level work faster (with less manual effort). With CBX, they can customize their organization’s policies for maximized protection with confidence and clarity across networks, endpoints, and data.

b6:T553,

Seeing is believing

If this sounds too good to be true, watch the CBX Fest session for yourself. CBX delivers a single-pane view, run by a single agent and unified console that makes web visibility, prevention, and customized policy tuning intuitive—without the need of toggling between screens or devices.

Unlike vendors who dress up hopes, dreams, and a couple of APIs and call it integration, CBX is the real deal. No matter where the data is, no matter where the users are, everything goes through the same simplified security stack, so it gets a comprehensive, seamless web traffic inspection, CASB controls, and a host of other built-in checkpoints. Network protection goes even further with web categorization, filtering, and sensitive data scanning to block web-based threats before they reach the browser.

It’s shoes off, check pockets for receipts style security that gives risky web activity a serious checkpoint before it can reach the endpoint.

b7:T701,

Two pillars of cluster state—both protected

The incremental index: Your scan memory

High Speed Discovery's Incremental mode builds an index of every file scanned—what was found and when. This is what makes subsequent scans focus only on changed content instead of re-inspecting the entire repository.

Before HDR support, that index lived solely on the data node. A hardware failure erased it, forcing every subsequent scan to restart from scratch. The incremental-index-backup command (Symantec DLP 25.1) captures the index as a timestamped zip file; incremental-index-restore brings it back to a new data node so the next scan resumes as incremental. Not a cold restart.

ART History: Your remediation intelligence

Automatic Remediation Tracking (ART) accumulates its intelligence over successive scan cycles, comparing current findings against prior incidents to determine whether a violation is still active, a file was modified, or a policy change resolved the issue.

Losing that history to a data node failure doesn't just inconvenience your team. It actively breaks ART. Previously resolved incidents can re-open; files already evaluated appear fresh to the engine. The art-backup command (Symantec DLP 26.1) protects this history, and art-restore brings it back coherent and continuous to the new data node.

A single command for both

The backup-all and restore-all commands Symantec DLP 26.1 give administrators a single operation that covers both: one zip file, one restore command, and a complete cluster state is recovered. No sequencing, no risk of restoring one without the other.

b8:T61f,

How the recovery process works

The full recovery sequence is documented in the Symantec DLP Help Center. But in practice, it can be summarized to three phases:

Before the disaster: Establish a backup routine. Run backup-all periodically from the data node, storing the output zip on storage outside the data node server. The frequency you choose determines how much work might need to be repeated after recovery.
When disaster strikes: Install one server, reconnect the rest. Install the data node software on a new server. Update the cluster IP in the Enforce console if needed (all policies and profiles re-sync automatically). Then run update-cluster-details on each worker node. This single command re-associates the worker node with the new data node—no reinstallation required.
After the disaster: Restore and resume. Run restore-all pointing at the backup zip. Once complete, run your existing scan targets unchanged. The cluster resumes from its last backup checkpoint.

b9:T487,

Built for recovery with zero disruptions

Disaster recovery shouldn’t create new problems while it’s solving existing ones. That’s why the Cluster Admin Tool is deliberately designed for safe production use. This tool:

☑️ Respects active scans. Backup and restore skip targets that are actively scanning, rather than interfering. Results are reported per-target in the backup manifest.

☑️ Protects in-progress operations. If a backup or restore is running for a target and a scan is triggered for that same target, the scan simply queues and waits. A Walk activity log entry explains exactly what’s happening.

☑️ Survives its own crashes. If the tool or the Detector process restarts mid-operation, the operation continues to completion on the data node. The tool reports the results the next time it’s launched.

☑️ Gives you visibility. The get-pending-command command reports the status of any in-progress operation — no black boxes during recovery.

ba:T502,

Picking up where you left off

We know how much time goes into building and maintaining a resilient discovery program. That’s why disaster recovery isn’t just about getting a cluster back online. It’s about protecting the work your team has already accomplished.

If you’re using Incremental Scan, disaster recovery support protects every investment your program has made in scan efficiency. Instead of starting from scratch after a data node failure, you can pick up right where your last backup left off. The same is true for ART. Support is not optional, but a prerequisite for reliable ART operation. Without it, a single outage resets the incident history that ART's classifications depend on.

These benefits also extend beyond day-to-day operations. Compliance teams won’t have to worry that a data node failure will derail scheduled scan cycles, with recovery measured in command executions rather than business days.

For operations teams, planned maintenance windows no longer need to be scheduled around active scan cycles. They can take the data node offline, restore when back, and resume scanning—all without touching a single scan target configuration.

bb:T42b,

Don’t just recover, resume

Disaster Recovery support is available now in Symantec DLP 25.1 with Incremental Index backup and restore, and expanded in Symantec DLP 26.1 to include ART backup and restore with backup-all and restore-all commands. Best of all, the Cluster Admin Tool ships as a standalone package, making it easier than ever to add these capabilities without modifying your existing installation.

For a complete breakdown of command syntax, parameters, prerequisites, and a step-by-step configuration, see the Network Discover Cluster Admin Tool documentation.

Not yet running High Speed Discovery? Reach out to your in-region expert for a 1:1 demo.

bc:T44b,

Great data, 0/10 user experience

Privileged Access Management (PAM) is one of the most data-rich systems in your security infrastructure. It knows who accessed what, when, where, and for how long. It holds your access policies, your privileged account inventory, your session history, your license utilization, and your compliance posture—all in one place.

Yet for most organizations, actually getting data out of that system is a friction-filled exercise. Compliance officers submit requests to administrators. Administrators build queries or custom scripts. Reports get generated, formatted, emailed, and by the time they land in an inbox, the underlying data has already changed. Next quarter, the request changes. The old script no longer fits and someone’s forced to build a new one.

This is not a technology failure. It is an interface failure. The data is there. The problem is that the only way to access it has been through static dashboards, scheduled reports, or bespoke scripts written by engineers with many other priorities.

bd:T77a,

How MCP bridges AI and PAM

The Model Context Protocol (MCP) is an open standard that allows AI models to connect directly to external systems through a structured set of tools. Think of it as a universal translator: your AI model asks a plain language question, the MCP server translates it into precise API calls against your PAM system, then returns structured data the model can summarize and explain in seconds.

By leveraging Symantec PAM's REST API through an MCP integration, every tool defined becomes available through your LLM and natural language. A compliance officer doesn’t need to know what endpoint returns session logs, nor does a manager need to understand how access policies are structured in the database. They simply ask—and a clear answer comes back.

4 ways AI makes PAM more useful

From static reports to live answers

Instead of a fixed weekly report, stakeholders ask freeform questions and receive accurate answers drawn directly from live PAM data—no intermediary, ticket queue, or wait.

From custom scripts to flexible reporting

When reporting requirements change (they always do)there is no script to rewrite. The AI model adapts to the new question immediately, combining multiple data sources in a single response without any engineering work

From siloed data to synthesized insight

A single AI query can span users, groups, access policies, session history, and device inventories while correlating information that would ordinarily require multiple reports and manual reconciliation.

From reactive reviews to continuous visibility

Rather than waiting for a compliance cycle to surface issues, an AI-backed system can surface anomalies, policy gaps, and license trends as they emerge, whether on a schedule or on demand.

The Detection Gap: MITRE ATT&CK T1003.001

6 Use Cases Security Practitioners Can Tackle With XDR

How To Take Prevention to the Web Layer

The Detection Gap: MITRE ATT&CK T1003.001

What Happens When Two Iconic Brands Unite?

The Cluster That Came Back: Disaster Recovery for High Speed Discovery

Explore Upcoming Events