Introducing Key Drivers: Panaseer's first AI feature

Why understanding the “why” behind your security metrics matters more than ever.
Key Drivers is an AI-powered feature that uncovers the root causes behind changes in cybersecurity metrics. It quickly analyzes vast amounts of data to highlight the most significant factors driving shifts, helping security teams move from detection to understanding and action in seconds rather than days.

Joan Nneji
read
Last updated: 6th August 2025

In this blog, we’re going to look at:

Why understanding the root causes behind security metric changes is more important than ever
How Panaseer AI’s Key Drivers deliver faster, clearer cybersecurity insights
What this means for the future of AI-powered cybersecurity workflows

The Challenge of pinpointing what’s driving change

Why is understanding change still one of the hardest problems in cybersecurity? Because visibility alone isn’t enough, and context is rarely where you need it, when you need it.

Security teams today are monitoring multiple key metrics across multiple tools. Control coverage shifts. Risk scores spike. Asset exposure increases overnight. But when those numbers move, the question that matters most “why?” is often the hardest to answer.

Investigating root causes means switching tools, wrangling data, chasing SMEs, and piecing together the story by hand. That's why we built Key Drivers, the latest addition to the Panaseer AI suite.

Key Drivers automatically identifies the root causes behind any metric change so teams can move from detection to insight in seconds. It scans millions of data points to surface the most statistically significant factors, then explains them in natural language and visuals that anyone on the team can understand. Instead of manual triage, you get trusted answers. Instead of guesswork, you get context-rich investigation paths. Instead of wondering where to start, your team already knows.

Introducing a smarter approach to root cause analysis

Key Drivers is a powerful AI-driven feature designed to tackle the complexity of root cause analysis in cybersecurity. It serves as an investigative assistant designed to pinpoint the most significant factors behind sudden changes in your security metrics.

Rather than just highlighting metric shifts or anomalies, Key Drivers digs deeper to explain why these changes happened, automatically and with precision.

Powered by advanced AI models, Key Drivers analyzes millions of control records across multiple dimensions in seconds. It surfaces the most statistically significant contributing factors behind metric changes, ranked by impact and accompanied by drillable data that can be exported to control owners or shared with risk committees.

For example, if a spike occurs in devices missing critical patch controls, Key Drivers might reveal that a particular business unit or older device type is the main driver. Or if phishing test failures increase, it could pinpoint a specific geography or user group responsible. This empowers security teams to quickly understand what’s happening and why, and to make informed decisions faster.

Key features of Key Drivers

Readily available insights on risk shifts: Security teams can define thresholds for critical metrics. When those thresholds are crossed, Key Drivers automatically initiates analysis and delivers timely, AI-generated insight into what changed and why.
Concise, report-ready summaries: Outputs are written in clear, concise language that can be copied and pasted directly into reports or shared with stakeholders, helping increase transparency and accountability.
Business-context filtering: To understand the root cause of metric changes, users can segment data by dimensions such as Device Type, Business Unit, Country, Criticality, and OS. This empowers teams to localize issues and assess their operational impact precisely.
Drillable asset-level insights: When carrying out more targeted investigations, teams can click into each contributing factor to reveal the specific systems, assets, or users driving the change. This accelerates investigations and supports focused responses in collaboration with control owners.

How it works

Detect change:
When a monitored metric shifts unexpectedly, Key Drivers automatically activates at the metric level.

Analyze data:
It scans millions of records across dimensions like business unit, device type, and OS to isolate meaningful drivers.

Explain drivers:
Contributing factors are ranked by impact and summarized in natural language for instant clarity.

Drill into details:
Filter by top drivers to see affected assets and refine the view for focused investigation.

Act confidently:
Use structured insights to support faster reporting, targeted remediation, and stronger audit narratives.

Use Cases: Redefining efficiency across the Cybersecurity workflow using AI

Manual investigation is one of the biggest time sinks in cybersecurity, with analysts spending over 50% of their time gathering and interpreting data before they can act. Automation transforms this bottleneck into a catalyst. In the SOC, it accelerates triage and reduces alert fatigue by instantly surfacing the most likely causes of change.

For GRC and risk teams, it standardizes root cause analysis, improving audit readiness and reducing the burden of compliance reporting. Security leadership gains faster, clearer insight into program performance without chasing fragmented context across tools.

By turning raw telemetry into focused, explainable insight, automated investigation streamlines collaboration, shortens response cycles, and frees experts to focus on what matters most: reducing risk.

Final word

Key Drivers is designed to translate complex cyber metrics into clear, actionable insights that empower teams to move quickly from detection to resolution.

This marks the start of a broader AI-driven transformation at Panaseer, focused on making cybersecurity safer, smarter, and more efficient. Upcoming innovations will enhance AI’s role by providing proactive pattern detection and tailored recommendations, all while strengthening oversight and governance to ensure responsible, transparent AI adoption.

The goal is to elevate security operations across the board, reducing risk, accelerating impact, and building trust in AI-powered cyber controls.