Palo Alto Networks is expanding its analytics and automation capabilities by acquiring Demisto, a security orchestration, automation and response (SOAR) provider, for $560 million in cash and stock.

The proposed acquisition is expected to close during Palo Alto’s fiscal third quarter, which ends next month, subject to regulatory approvals and other customary closing conditions.

Palo Alto Networks’ Nikesh Arora

“Coupled with our application framework, Demisto will help us strengthen our commitment to security teams by delivering a platform that provides higher levels of integration, automation and innovation to prevent successful cyberattacks,” said Nikesh Arora, Palo Alto‘s chairman and CEO.

Palo Alto has entered a quiet period and wouldn’t provide any further comment regarding impact to partners of both companies.

Palo Alto said the addition of Demisto‘s orchestration and automation technologies will serve as a “critical step forward in the company’s aim to deliver immediate threat prevention and response for security teams.” Demisto’s automated playbooks have helped reduce alerts that require human review by as much as 95 percent, allowing security teams to focus on the most complex threats, it said.

This approach will bring Palo Alto closer to using AI and machine learning to help further automate significant parts of the company’s customers’ security operations.

Demisto’s go-to-market strategy has attracted more than 150 customers, a quarter of which are in the Fortune 500 and include large organizations in health care, high technology, financial services and other industry verticals. Demisto said it plans to continue executing its aggressive growth plans and will leverage Palo Alto’s distribution to achieve its goals. At the same time, Demisto will work closely with the Palo Alto team to strengthen its existing integration with the application framework.

“We have dedicated ourselves to the challenge of automation because we believe that relying on people alone to combat threats will fail against the scale of today’s attacks,” said Slavik Markovich, Demisto’s CEO. “Palo Alto Networks strategy resonates with our own vision. And we have found a like-minded team that shares our conviction that the future of security is all about automation and AI. We’re thrilled to be joining them to help make it a reality.”

Demisto’s products will continue to be available to customers and partners after the transaction closes. Demisto founders Markovich, Rishi Bhargava, Dan Sarel and Guy Rinat will join Palo Alto.

Dario Forte, CEO of DFLabs, a SOAR vendor, said the acquisition demonstrates the “increasing role and importance of security incident response within the IT security stack.”

“For Palo Alto Networks and others, adding SOAR to their portfolio is the result of growing customer demand for these capabilities,” he said. “Savvy organizations recognize that breaches, no matter how many defensive mechanisms they have in place, are inevitable. One of the biggest requirements and challenges in deploying SOAR technology is integrating third-party products like next-generation firewalls from Palo Alto Networks, security information and event management (SIEMs), etc. This acquisition will open the door for increasing adoption of SOAR by organizations and MSPs, as well as more acquisitions of other leading SOAR vendors.”