The last few years have seen a surge of interest in security orchestration and automation (SOA) and how security operations teams can benefit from its adoption. The security orchestration, automation and response (SOAR) market, as defined by Gartner in 2017, evolved from three previously distinct technologies: SOA, security incident response platforms (SIRPs) and threat intelligence platforms (TIPs).

This convergence of three complementary technology areas has magnified the importance of SOAR tools and their increased adoption by security operations teams. In its new market guide, Gartner predicted that, “By year-end 2022, 30 percent of organizations with a security team larger than five people will leverage SOAR tools in their security operations, up from less than 5 percent today.”

A key reason for this growing demand is the pressure on security operations teams to meet an increasing volume of attacks, which are becoming more complex and severe. Gartner points out in the market guide, “As organizations consider threats that destroy data and can result in disclosure of intellectual property and monetary extortion, they require rapid, consistent, continuous and more frequent responses with fewer manual steps.”

Why Are Organizations Adopting Security Orchestration, Automation and Response (SOAR)?

Security teams are adopting SOAR tools to meet key use cases that can deliver short-term benefits. Gartner identified three key areas of security operations decision-making where SOAR tools can add value:

1. Prioritizing security operations activities
2. Formalizing triage and incident response
3. Automating response

All of these areas can reduce the human power needed to operationalize the response process. As noted in the report, “Speed is of the essence in today’s threat landscape,” and organizations that can react quickly in a consistent manner will be best equipped to reduce their time to detect and respond to threats.

The Gartner report also highlighted some important areas for security teams to consider about their deployment and utilization of SOAR tools. The first is that organizations should “prepare for their SOAR implementations by having a starting set of defined processes and workflows that can be implemented.” Gartner also addressed this theme earlier this year in a report titled, “Make Sure Your Organization Is Mature Enough for SOAR.”

Establishing incident response plans and processes is a critical first step toward wider adoption of security automation, and it also forces organizations to consider their current processes to ensure that they are fit for purpose. Every organization has different policies, procedures and technology implementations, so it is sensible to work both with your chosen SOAR vendor’s professional services team and internal resources to review your existing processes and consider what customizations are appropriate to get the highest return on your investment in SOAR tools.

The Future for SOAR

The SOAR market is still emerging. As Gartner noted, client feedback suggests that current use cases are primarily focused on security operations center (SOC) efficiency, allowing analysts to process more incidents and drive response actions much more quickly by enriching security information and event management (SIEM) alerts with threat intelligence and context, and reducing false positives by improving the signal-to-noise ratio.

As clients continue their SOAR journeys, they can look beyond SOC efficiency and consistency gains; Gartner pointed to the potential of using orchestration and automation capabilities for cloud security and nonsecurity use cases.

Access the full report for more information about common SOAR use cases and how your security operations team can benefit today by adopting SOAR solutions, plus recommendations to help you maximize the value of your SOAR deployment.

Gartner, Market Guide for Security Orchestration, Automation and Response Solutions, Claudio Neiva, Craig Lawson, Toby Bussa, Gorka Sadowski, 27 June 2019

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.