Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Orchestration Is Saving Enterprise Security Teams
Transcript
- Lucas: If you work in enterprise security, you've probably felt this: your team is drowning in alerts from a dozen different tools, and every analyst has their own manual workflow for handling them. Luna: Right — it's like each threat is a unique snowflake, and you're just hoping nothing slips through. Lucas: Exactly. That chaos is exactly what security orchestration, automation, and response — SOAR — is designed to fix. It's essentially a middleware layer that connects your existing security tools, standardizes workflows, and automates repetitive tasks. Luna: So it's not a replacement for your existing tools, it's the glue between them. Lucas: Right. And it's becoming a fast-growing category. Gartner first coined the term back in 2015, but adoption really took off around 2020. By the end of last year, roughly 40 percent of large enterprises had deployed some form of SOAR. Luna: And this year, with AI making playbooks smarter, I'd bet that number is climbing. Let's get concrete — what does a SOAR playbook actually look like in practice? Lucas: Good question. Let me give you a specific example from a mid-tier financial services firm I spoke with recently. They had about 15 people in their SOC, and they were getting roughly 10,000 alerts per day across their SIEM, endpoint detection, email security, and cloud monitoring tools. Luna: That's about 667 alerts per analyst per day. Completely overwhelming. Lucas: Exactly. They deployed a SOAR platform — in this case, an open-core solution with connectors to their major tools. Their first playbook was for phishing emails. When an employee reports a suspicious email, the SOAR platform automatically extracts the headers, checks the URLs against threat intelligence feeds, isolates the mailbox if needed, and opens a ticket — all in about 90 seconds. Luna: And before, an analyst would have done all of that manually, right? Probably taking 15 minutes per incident. Lucas: Closer to 20. And with hundreds of phishing reports per day, that's hours of time freed up. Their mean time to respond dropped from 45 minutes to just under 4 minutes for automated playbooks. They also reduced false positive noise by routing low-confidence alerts into a queue where they're automatically enriched and only escalated if certain thresholds are hit. Luna: So the analysts can focus on the real threats instead of chasing phantoms. What about the cost side? Lucas: They estimated their annual incident response costs dropped by about 40 percent, mostly because they avoided overtime and burnout-related turnover. And they reduced the number of missed incidents from an average of 12 per quarter to zero in the first six months. Luna: That's a strong ROI story. But I've also heard criticism that SOAR can be too rigid — that if you automate too much, you miss context that only a human analyst can catch. Lucas: That's a real tension. The best SOAR implementations I've seen use automation for the high-confidence, low-complexity cases — like known-bad IPs or phishing URLs that match threat intel — and only escalate ambiguous situations to humans. The key is designing playbooks with clear decision points where an analyst can override. Luna: So it's not 'set it and forget it.' It's more like a co-pilot that handles the routine, but keeps the pilot in the loop for unusual cases. Lucas: Exactly. And the platforms themselves are getting smarter. Today, many SOAR tools integrate machine learning to suggest playbook improvements based on past incidents. For example, if a certain alert type regularly gets escalated, the system might recommend a new automated response for that scenario. Luna: So the playbooks evolve over time. That makes sense. What about the market landscape — who are the major players? Lucas: The two biggest dedicated vendors are Splunk Phantom and Palo Alto Networks' Demisto, though both have been acquired and integrated. Splunk bought Phantom in 2018, and Palo Alto bought Demisto in 2019. There's also IBM Resilient, ServiceNow's Security Operations, and newer players like Swimlane and D3 Security. Luna: And SIEM vendors are building SOAR features directly into their platforms as well, right? Like Microsoft Sentinel and Elastic Security. Lucas: Right — that's a trend to watch. The line between SIEM and SOAR is blurring. Some analysts argue that in five years, SOAR won't be a standalone product; it'll be a standard module within every security operations platform. Luna: But for now, most enterprises still need a dedicated SOAR tool to stitch together legacy systems that don't talk to each other. Lucas: Exactly. And that's where the ROI is clearest. One thing I find interesting: the adoption rate is much higher among regulated industries — finance, healthcare, energy — where compliance mandates require documented escalation processes. SOAR makes it easy to prove that every alert was handled according to policy. Luna: Audit trail built in. That alone can save a company millions in fines. So, what's the biggest mistake companies make when adopting SOAR? Lucas: Trying to automate everything at once. The firms that succeed start with one or two high-volume, low-complexity use cases — like phishing triage or vulnerability alert enrichment — and then expand gradually. The ones that fail try to build a massive, complex playbook on day one and end up with a system that's too brittle to maintain. Luna: Start small, prove value, iterate. That's a solid blueprint. And it's exactly the kind of practical insight that makes this show useful for people building or running security programs. Lucas: That's the goal. And speaking of useful — if today's episode helped you understand SOAR a little better, or gave you a concrete example to take to your team, we want to keep these conversations coming. The reason we can stay ad-free and focused on substance is listener support. If you'd like to chip in, it's buy me a coffee dot com slash fexingo. Luna: Yeah — every contribution goes straight into keeping the show independent and zero-fluff. Even a coffee helps, and it means a lot. Lucas: Now, back to the playbooks. One emerging trend I'm tracking is the integration of SOAR with generative AI. Some platforms now let you describe a desired outcome in natural language, and the AI generates a draft playbook. Luna: So instead of an analyst writing complex code or dragging and dropping logic blocks, they can just say 'If a user reports a phishing email, check the URL and block it if malicious' and the system creates the workflow. Lucas: Exactly. That lowers the barrier to creating custom playbooks, which means smaller teams can adopt SOAR without dedicated automation engineers. I've seen a handful of early pilots where SOC analysts without coding backgrounds successfully built playbooks this way. Luna: That democratization feels significant. But I'm guessing there are security risks — what if an ai generated playbook has a logic flaw that leads to a misconfiguration? Lucas: That's the big open question. Vendors are adding validation layers — essentially testing the generated playbook against a set of safety rules before it goes live. But human review is still critical. It's a tool, not a replacement for judgment. Luna: So we're back to that human-in-the-loop model. One thing I appreciate about the SOAR approach is that it doesn't try to replace analysts, it makes them more effective. Lucas: That's the right framing. In a world where the average SOC analyst burns out after two years, any tool that reduces the drudgery and lets them focus on interesting threats is a win for retention and security outcomes. Luna: And for the business, it's a clear cost savings. That's the beauty of SOAR — it's one of those rare security investments where you can actually measure the ROI in months, not years. Lucas: Absolutely. If you're running a security team and you haven't looked at SOAR yet, this year — with ai enhanced playbooks and easier adoption paths — might be the right time to start.