Security operations centers (SOCs) handle large volumes of repetitive work, and there is no good reason for an analyst to perform every step by hand. Security orchestration, automation, and response (SOAR) automates repeatable work across security operations.
A SOAR playbook can enrich an alert, open a ticket, pull in threat intelligence, take an approved containment action, or pass the case to an analyst. Automating these routine steps saves analysts from doing the same work every time an alert comes in.
SOAR follows predefined instructions, but those instructions depend on the information feeding the workflow. Security teams have no shortage of findings they could act on, but they still need to work out which ones need attention first.
Why do SOAR playbooks break?
Most SOAR playbooks start with a process the security team already understands.
Take a phishing investigation. The team knows which checks it normally performs, where it gets the information, and how it responds when an email looks malicious. Those steps can be turned into a workflow and repeated whenever the same type of alert appears.
The trouble starts when the environment changes. A team adds another cloud service. An application moves. A data source changes. Someone replaces a security tool. A new alert does not quite fit the conditions the team wrote into the original playbook.
None of this means the playbook was badly designed, but somebody has to keep it current.
As SOAR deployments grow, that work grows with them. Security engineers have to maintain integrations, check triggers and actions, update approval points, and make sure workflows still reflect how the organization operates. A large playbook library can therefore carry a significant maintenance cost.
Some investigations also resist being reduced to a fixed sequence. An analyst may start with one alert, find something unexpected, and follow a completely different line of investigation. You cannot always know the fifth step when you are writing the first.
SOAR works well when the path is known. Security operations regularly deals with cases where it isn’t.
What is SOAR missing?
Context about the risk behind the alert.
Alert fatigue usually gets discussed in terms of volume. Too many alerts arrive, analysts cannot investigate all of them, and automation helps deal with the workload.
That only gets you so far. You still have to decide which work is worth doing.
Suppose two vulnerabilities both carry a high severity rating. One affects an isolated, low-value system and has no known route to anything important. The other sits on an internet-facing asset, has known exploitability, and forms part of an exploitable attack path to a critical system.
A severity score alone does not tell the SOC enough about those two situations. This is where exposure context becomes useful. Teams can look at:
- Evidence of active exploitation
- Asset criticality and business function
- Exploitable attack paths
- Relationships with other exposures
- Potential business impact
That is also the thinking behind risk-based exposure prioritization: use exploitability, asset criticality, business context, and likely impact to decide what deserves attention.
With that context, the SOC can be more selective about what it automates. A high severity rating alone does not have to trigger the fastest response if other findings pose a more immediate risk.
Where does adaptive AI investigation fit?
Some security investigations are difficult to turn into playbooks because the next step depends on what the previous step uncovers.
That is where adaptive artificial intelligence (AI) investigation gets interesting.
An agent can start with an alert, pull information from several sources, and use what it finds to decide where to look next. The investigation can then change direction as new evidence emerges, rather than being limited to the steps set out in a playbook.
There is still plenty of work for traditional SOAR. Ticket creation does not suddenly require an AI agent, nor does every enrichment task or approved response action. If a team already knows the process and trusts it, a playbook remains an efficient way to run it.
AI becomes more useful when the investigative path is harder to predict. It also makes context more important. Giving an agent access to more security data will not tell it which exposure matters most. It needs information about the affected asset, exploitability, identities, attack paths, and likely business impact to make a useful assessment.
Teams also need to decide where the agent’s authority ends. Gathering evidence is very different from isolating a production host. AI-driven security operations still need clear approval points for actions that could affect users, systems, or business operations.
What should security leaders ask before putting more into SOAR?
A useful SOAR review should look beyond the number of playbooks running or alerts processed.
Start with what occurs before a playbook fires.
- Context available to the playbook. Does the workflow know what the affected asset does and how important it is to the business?
- Investigations outside existing playbooks. Look at the cases that regularly require analysts to leave or work around the established workflow.
- Automation maintenance. Account for time spent updating integrations, data sources, tools, triggers, and playbooks.
- Value of the work being automated. Check whether the SOC is automating work because it matters or because the workflow is easy to automate.
- Analyst context gathering. Find out how often analysts still have to establish whether a case matters after the automated steps have finished.
- Human approval points. Define which actions require review because they could disrupt systems, users, or business processes.
These questions give vulnerability management and SOC teams a better picture of where the time goes. They can also expose an awkward situation: the automation itself may be working perfectly while the prioritization around it needs attention.
SOAR is only as useful as the work you give it
Security teams should automate repetitive work. Asking analysts to manually enrich the same alerts, create the same tickets, and carry out the same routine actions makes little sense when a reliable workflow can handle them.
What enters these workflows has an impact. Exposure context helps teams decide which findings warrant a response before they automate it.
Adaptive AI investigation will allow security teams to automate more of the work around established SOAR playbooks. As that happens, teams will need to check that automated workflows still have the risk context they need and that analysts remain involved where judgment or approval is required.
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora.
Additional Resource
Video Overview
Infographic
Follow Brilliance Security Magazine on LinkedIn to ensure you receive alerts for the most up-to-date security and cybersecurity news and information. BSM is cited as one of Feedspot’s top 10 cybersecurity magazines.