Sabre’s cybersecurity defenses take off, fueled by Unit 42

Sabre’s previous incident response provider required that resource-heavy agents be deployed across the server fleet, adding a burden that would slow down containment efforts. Additionally, because the vendor only supported its own tool set, it didn’t use Cortex XDR, and a learning curve would delay response times. “We wanted an IR partner that is both recognized and aligned around our technology,” explains Matthew Bissell, Senior Director of Cloud Security and Response. “The Unit 42 Retainer gives us immediate access to IR experts who understand our technology, layering in the global threat and attack vector perspective. That enables us to act very quickly when we need to contain threats and minimize disruptions.”

Increasingly, Sabre’s customers have been requesting—even requiring—third-party cybersecurity program validations to meet regulatory and insurance demands. One customer required that a new environment be confirmed as secure ahead of production implementation (and annually after that). To comply, Sabre enlisted Unit 42 to run a compromise assessment, which assured the customer that the environment was protected as intended. “As we build agreements with a customer that might require these assessments,” Bissell explains, “we work with them to understand what assurances are most important to them and focus on scoping the assessment appropriately.”

For several years, Sabre’s internal team had been performing tabletop and limited red team exercises. In 2024, the organization expanded to third-party testing, using its Unit 42 Retainer credits for proactive services. Bissell explains: “This was about shifting from doing an intellectual exercise that involves talking something through to simulating a real-world advanced persistent threat attack—done in a safe space that the team wasn’t aware of.”

The results were affirming. During Unit 42 Red Team Exercises, the team gained a temporary foothold into Sabre’s perimeter network, but within minutes, Cortex XDR identified the intrusion, alerted the team, and automatically blocked the attack. “They found an exploit in a web application—there was an input-type exploitation,” reports Peck. “But the tools went above and beyond. XDR took care of business.”

Unit 42 discovered 10 vulnerabilities in the exercise. One high-risk item was remediated within an hour after identification by Unit 42, reducing Sabre’s attack surface. All told, 90% of vulnerabilities were remediated during or after the test; during the retest, 100% of the previously exploited vulnerabilities were no longer exploitable.

For Sabre, one of the benefits of working with Palo Alto Networks technology has been a precipitous decrease in the mean time to contain (MTTC). “We used to have a target of seven days for low-priority incidents and three for high-priority ones,” reflects Bissell. “Since we’ve changed our tooling and moved to Cortex XDR, we’ve been able to get that rate down to hours for all incidents.”