Demo Request
Take a personalized product tour with a member of our team to see how we can help make your existing security teams and tools more effective within minutes.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Home
Blog

Automate SaaS Security & Data Exposure Risk with Palo Alto Networks & Reco

Gal Nakash
Updated
January 17, 2024
August 20, 2026
5 min read
Ready to Close the SaaS Security Gap?
Chat with us

Reco Content Pack available now on the Cortex XSOAR Marketplace.

Contextual SaaS security is crucial to SaaS misconfigurations in a security environment. Unfortunately, security teams rarely have the time or resources to fully protect against SaaS data security & misconfigurations. Context, resources, and time are just some of the many limitations to protecting your dynamic SaaS environment.

To overcome the emerging threats of Software-as-a-Service (SaaS) applications, Reco and Palo Alto Networks are excited to share that the new Reco  content pack is now available within the Cortex XSOAR Marketplace. By leveraging the Reco content pack, security teams gain a multitude of benefits. Reco's built-in rules automatically assess over 100 configuration rules unified across SaaS applications. This empowers security teams to gain better visibility into potential SaaS misconfigurations and take proactive measures to mitigate them. The integration with Cortex XSOAR enables Reco to detect misconfigurations in near real-time and trigger automatic remediation flows, seamlessly integrating these alerts into Cortex XSOAR's incident management system for prompt and effective response. Furthermore, the contextual layer provided by Reco enriches incident data with valuable insights, facilitating quicker analysis and decision-making. With the Reco content pack, security teams can also leverage prebuilt playbooks within Cortex XSOAR to automate the entire process of identifying and remediating SaaS misconfigurations and sensitive data exposure risks, reducing manual effort, accelerating incident response, and improving overall security posture.

Why This Is So Important for Your Security Program

Together, Reco and the Cortex XSOAR enable your security and IT teams to effectively secure SaaS applications. Reco platform enables a reduction in  SaaS data risk by enforcing user-data centric security policies and embracing new SaaS applications at a faster rate, resulting in future proof for compliance & regulatory requirements.

Reco Google Drive Playbook Automation
Excerpt from the Reco Google Drive Automation playbook for Cortex XSOAR

The Reco content pack enables you to:

  • Automate SaaS security to discover misconfigurations.
  • Recover rapidly from SaaS misconfiguration and increase resiliency against new attacks with Reco and Cortex XSOAR.
  • Automatically identify and classify data, identities & SaaS applications, enriching incidents from different platforms with Reco context.
  • Eliminate data exposure risks and misconfigurations and navigate with speed across your workloads and unstructured data, reducing the time it takes to investigate and respond to threats.

Learn More

Build out your security program with the Reco Content Pack, available now on the Cortex XSOAR Marketplace. Look up pre-built integrations for your top security tools with over 985 content packs available for Cortex XSOAR, the market’s leading SOAR platform. 

Don’t have Cortex XSOAR? Download the Community Edition to get started. 

FAQs

How does Agentic AI Security differ from traditional application security?

Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged.

  • test point
  • test point 2
  • test point 3

What are the risks of unsecured Agentic AI?

Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged.

  • test point
  • test point 2
  • test point 3

Gal Nakash

ABOUT THE AUTHOR

Gal is the Cofounder & CPO of Reco. Gal is a former Lieutenant Colonel in the Israeli Prime Minister's Office. He is a tech enthusiast, with a background of Security Researcher and Hacker. Gal has led teams in multiple cybersecurity areas with an expertise in the human element.

Technical Review by:
Gal Nakash
Technical Review by:
Gal Nakash

Gal is the Cofounder & CPO of Reco. Gal is a former Lieutenant Colonel in the Israeli Prime Minister's Office. He is a tech enthusiast, with a background of Security Researcher and Hacker. Gal has led teams in multiple cybersecurity areas with an expertise in the human element.

Table of Contents
Let’s Talk About Your Non-Human Users
Chat with us
Get the Latest SaaS Security Insights
Subscribe to receive updates on the latest cyber security attacks and trends in SaaS Security.

Explore Related Posts

LWR Is the New Aura: A Pentester's Guide to Salesforce's WebRuntime API
Nitay Bachrach
Salesforce Experience Cloud sites - public-facing web apps that run natively on top of a Salesforce org - are one of the most consistently under-scrutinized parts of the Salesforce attack surface. They're reachable by anyone with a browser, they're driven by a guest user identity that inherits whatever sharing rules and object permissions an admin configured for it, and unlike the rest of the org, nothing about them requires a login to start probing.
Two Frontier Labs, Two Weeks, One Root Cause: What Anthropic's Eval Incident Tells Us About Agent Security
Tal Shapira
On July 30, Anthropic published a retrospective on three cybersecurity evaluation incidents involving its Claude models. It's a striking piece of transparency — and it lands just weeks after OpenAI disclosed something strikingly similar involving Hugging Face.
The “City-Forum” Campaign - An advanced attacker is targeting Salesforce and ServiceNow instances worldwide
Nitay Bachrach
Reco is tracking an ongoing campaign we've named the City-Forum Campaign, after a domain tied to the threat actor's IP (more on that below). A single server is pulling records out of Salesforce Experience Cloud sites and ServiceNow (SNOW) Service Portals, from infrastructure that has been standing since March 2025.
See more featured resources

Your agents are already running. Do you know what they're doing?

Request a demo