In a data-rich environment, speed wasn’t scaling.
RealPage handles personally identifiable information (PII) and sensitive data in financial transactions, a responsibility that demands both powerful security and extraordinary speed. Its existing infrastructure was struggling to deliver.
- Fragmented, multivendor SOC tools lacked native integration, forcing analysts to manually correlate events across disconnected systems and leaving critical blind spots.
- Alert volumes without intelligent prioritization flooded analysts with noise and false positives, making it nearly impossible to focus on genuine threats.
- A rapidly expanded attack surface from a major cloud migration was putting the business at risk, with no comprehensive visibility across hundreds of cloud projects.
- Existing remote access tools couldn’t adequately control the exposure from a growing hybrid workforce spread across global networks and SaaS applications.
Building a security portfolio that scales with ambition.
RealPage’s security transformation began with Cortex XSOAR®, which demonstrated that the right automation could fundamentally change what a lean team was capable of. Impressed by what XSOAR’s playbooks and orchestration made possible, RealPage chose to go all in, transitioning to Cortex XSIAM for a platform that brought SOAR capabilities and much more under one roof. From there, the partnership expanded across the full Palo Alto Networks portfolio, addressing each of RealPage’s core challenges with an integrated architecture built for the speed and scale of AI-enabled threats.
Path to Platformization
AI-driven SOC transformation
Cortex XSIAM
AI-driven cloud security
Cortex Cloud
Agentic AI and automation
Cortex AgentiX
Network security and secure remote access
- PA-Series NGFW
- VM-Series NGFW
- CDSS
- Prisma Access
- ADEM
Proactive and incident response services
- Unit 42 Retainer
- Unit 42 Proactive Services
- Unit 42 Incident Response
-
Stitching it all together, at last
At the time, RealPage was contending with tens of data sources that needed to be correlated for an end-to-end understanding of events. Too many incidents were slipping past point-solution tools, and manual correlation was far too labor-intensive. Today at RealPage, 32 data sources are ingested into XSIAM, giving the company unprecedented visibility across its entire security environment. The platform processes 351 TB of data and distills it into roughly 122 enriched cases per day. Of those, 99% are resolved automatically, leaving only 1% to reach a human analyst. The impact on speed has been transformative, with median time to resolution plummeting from 33 minutes to 13 seconds. The agility has also been crucial. Operationally, the use of Cortex XSIAM has freed RealPage’s lean security team from a perpetually reactive posture. Analysts who once spent their days triaging alerts now focus on AI-driven vulnerability analysis, proactive threat hunting, and building next-generation automation.
-
Cloud visibility that bridges security and development teams
As RealPage embarked on a major cloud migration, the security implications were profound. First, it was a significant expansion of the company’s attack surface. Second, since the company manages PII for millions of residents, maintaining comprehensive cloud visibility is nonnegotiable when embedding AI across its platform. Cortex Cloud provided the answer, offering visibility across hundreds of projects across multiple cloud service providers. Helpfully, its built-in integration with XSIAM made the transition feel seamless. It also opened up a new channel of collaboration among security, developers, and cloud operations, giving teams shared visibility and enabling faster, more precise conversations about what needs to be fixed and why.
-
Zero trust security for a distributed workforce
With employees distributed across multiple continents and an expanding catalog of SaaS applications (all handling sensitive resident and financial data), RealPage needed a zero trust approach to remote access that could keep pace. After a thorough evaluation of the leading solutions, the team selected Prisma Access for its depth of visibility, granular control, and access to the intelligence that comes with the Palo Alto Networks portfolio. Complementing Prisma Access, RealPage has also deployed Autonomous Digital Experience Management, which provides deep visibility into performance and connectivity insights crucial for quickly pinpointing and troubleshooting network issues across their worldwide team.
-
Unit 42: A force multiplier for a lean team
RealPage maintains a Unit 42 Retainer as a permanent, strategic fixture of its security program, not just as a break-glass resource but as a deliberate complement to its in-house capabilities. The company regularly directs its retainer credits toward proactive services, particularly Deep and Dark Web Services monitoring. These engagements have surfaced threats that automated tools hadn’t flagged, reinforcing the continuing value of human expertise alongside AI-driven platforms. When RealPage does engage Unit 42 for incidents, the expert responders are already adept with XSIAM, a decisive advantage that allows them to get to work without delays for ramp-up. The relationship also allows RealPage to keep its own security team lean without compromising capability.
“We're investing in companies like Palo Alto Networks so we can show a proactive approach to cybersecurity. We're looking forward to what's on the horizon, not just what's in the wild today.”
— Lance French
CIO, RealPage
-
The next frontier: AI agents fighting AI threats
RealPage is looking forward to using the agentic AI capabilities of Cortex AgentiX, which is natively embedded in Cortex Cloud and XSIAM. The intelligent agents can plan and execute complex workflows autonomously while the RealPage team can easily build its own custom agents to augment day-to-day operations. This streamlined approach means analysts can resolve incidents faster without waiting for group triage calls. As RealPage continues to deepen its AI-first strategy, the company is also evaluating Prisma AIRSTM to help secure developers as they build AI applications and agents in customer-facing solutions.
How security becomes a competitive advantage.
For RealPage, Palo Alto Networks represents more than a vendor relationship. The technology has delivered measurable results at every level, but the trust and strategic alignment have proven equally valuable. For CIO Lance French, the investment in the Palo Alto Networks platform carries weight that goes beyond operational security. The company actively shares its security posture and partnerships with customers as evidence of trustworthiness, a differentiator in an industry where the stakes of a data breach extend beyond the organization itself. French explains, “At RealPage we’re experts in multifamily. We rely on Palo Alto Networks to be the experts on cyber.” The same qualities that make RealPage a compelling technology partner for the real estate industry—innovation, data stewardship, and trust—are underpinned, in no small part, by the security infrastructure that runs beneath them.
“To be on that cutting edge, we have to make sure we’re investing in the platform and our ecosystem of partners. Our top partner from an InfoSec perspective is Palo Alto Networks.”
— Lance French
CIO, RealPage
share this story
