Incidents are the first indication that there is a problem in the network. They are often precursors to a much more serious disaster, if not responded to. If incident response (IR) is not planned and executed effectively, the results can be catastrophic. When an incident occurs, it means something out of the norm has happened.
Regardless of severity, an incident is any event that, if unaddressed, may lead to a business interruption or loss. At the same time, the more tools an organisation runs, the more alerts they receive, and it becomes harder for analysts to respond to each alert manually in a timely manner.
What automation actually solves
The number of tools is increasing faster than the workforce. The same number of SOC staff are dealing with more alerts and more tools.
Three challenges SOC staff face
IR is a manual process. Tasks range from fetching data to malware detection. Getting everyone on the same page, tracking events, communicating the problem with the team. Manual processes kill overall IR productivity.
IR is dysfunctional. The SOC team finds the fires but counts on IT operations to fight the flames. This relationship is not always a perfect marriage. A third of cyber security professionals say coordinating IR activities across cyber security and IT operations is one of their top challenges.
The skills shortage. Research from Enterprise Strategy Group reported 45 percent of organisations have a problematic shortage of cyber security skills. Understaffed and under-skilled SOC teams depend on individuals and manual processes to get the job done.
Where the budget is going
Most of the three challenges above can be eased by automation and orchestration. Around 45 percent of CISOs across the US believed their IR budgets would increase significantly in the year ahead. A big portion was earmarked for automation and orchestration.
Originally published 22 March 2017. Migrated to the new IRC site in 2026.