Security automation (SOAR)

What it does for a business

The cost of a security operations team is analyst time. Most of that time is spent doing work a machine should do: pulling context onto an alert, deciding which of two hundred procedures applies, writing the same containment steps for the tenth time this quarter.

Automating that changes the economics twice. The obvious saving is headcount, because a five-person team can carry what previously kept a larger one busy. The less obvious one is consistency: automated response does the same thing every time, on the incident where nobody senior is awake yet.

The alternative most teams are offered is an enterprise SOAR contract sized and priced for a large organisation, followed by a six-month integration project billed on top. The work of building the automations is the part that actually costs money. It is also the part that usually does not get finished.

Shipped proof

• 656 runbooks, one per MITRE ATT&CK technique and sub-technique, across 203 techniques, each carrying investigation questions, key indicators, containment steps and escalation reasoning. Generated by script, not written by hand. Lono Security
• Live in two weeks against the six months a conventional integration asks for, on a flat monthly rate instead of a contract plus a project. Lono Security
• Scoped credentials and route allowlists enforced in one place rather than re-implemented in every automation. Six auth schemes including OAuth2, HMAC and AWS SigV4, with secret injection and an audit store. SubOracle
• Cut manual triage effort by roughly 87 percent on targeted indicator workflows for one SOC team, measured against its own prior baseline. A relative reduction on specific high-volume workflows, not a uniform SOC-wide metric.

Stack

What this solves

The bottleneck is analyst attention. The runbook is the product. If your team is drowning in alerts that each need the same context assembled by hand, this is the layer that removes the assembling.