The last few years have seen a surge of interest in security orchestration and automation (SOA) and how security operations teams can benefit from its adoption. The security orchestration, automation and response (SOAR) market, as defined by Gartner in 2017, evolved from three previously distinct technologies: SOA, security incident response platforms (SIRPs) and threat intelligence platforms (TIPs).

This convergence of three complementary technology areas has magnified the importance of SOAR tools and their increased adoption by security operations teams. In its new market guide, Gartner predicted that, “By year-end 2022, 30 percent of organizations with a security team larger than five people will leverage SOAR tools in their security operations, up from less than 5 percent today.”

A key reason for this growing demand is the pressure on security operations teams to meet an increasing volume of attacks, which are becoming more complex and severe. Gartner points out in the market guide, “As organizations consider threats that destroy data and can result in disclosure of intellectual property and monetary extortion, they require rapid, consistent, continuous and more frequent responses with fewer manual steps.”

Why Are Organizations Adopting Security Orchestration, Automation and Response (SOAR)?

Security teams are adopting SOAR tools to meet key use cases that can deliver short-term benefits. Gartner identified three key areas of security operations decision-making where SOAR tools can add value:

  1. Prioritizing security operations activities
  2. Formalizing triage and incident response
  3. Automating response

All of these areas can reduce the human power needed to operationalize the response process. As noted in the report, “Speed is of the essence in today’s threat landscape,” and organizations that can react quickly in a consistent manner will be best equipped to reduce their time to detect and respond to threats.

The Gartner report also highlighted some important areas for security teams to consider about their deployment and utilization of SOAR tools. The first is that organizations should “prepare for their SOAR implementations by having a starting set of defined processes and workflows that can be implemented.” Gartner also addressed this theme earlier this year in a report titled, “Make Sure Your Organization Is Mature Enough for SOAR.”

Establishing incident response plans and processes is a critical first step toward wider adoption of security automation, and it also forces organizations to consider their current processes to ensure that they are fit for purpose. Every organization has different policies, procedures and technology implementations, so it is sensible to work both with your chosen SOAR vendor’s professional services team and internal resources to review your existing processes and consider what customizations are appropriate to get the highest return on your investment in SOAR tools.

The Future for SOAR

The SOAR market is still emerging. As Gartner noted, client feedback suggests that current use cases are primarily focused on security operations center (SOC) efficiency, allowing analysts to process more incidents and drive response actions much more quickly by enriching security information and event management (SIEM) alerts with threat intelligence and context, and reducing false positives by improving the signal-to-noise ratio.

As clients continue their SOAR journeys, they can look beyond SOC efficiency and consistency gains; Gartner pointed to the potential of using orchestration and automation capabilities for cloud security and nonsecurity use cases.

Access the full report for more information about common SOAR use cases and how your security operations team can benefit today by adopting SOAR solutions, plus recommendations to help you maximize the value of your SOAR deployment.

Gartner, Market Guide for Security Orchestration, Automation and Response Solutions, Claudio Neiva, Craig Lawson, Toby Bussa, Gorka Sadowski, 27 June 2019

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

More from Intelligence & Analytics

ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)

7 min read - In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others. ITG10's tactics, techniques and procedures (TTPs) overlap with APT37 and ScarCruft. The initial delivery method is conducted via a LNK file, which drops two Windows shortcut files containing obfuscated PowerShell scripts in charge of downloading a…

7 min read

SOCs Spend 32% of the Day On Incidents That Pose No Threat

4 min read - When it comes to the first line of defense for any company, its Security Operations Center (SOC) is an essential component. A SOC is a dedicated team of professionals who monitor networks and systems for potential threats, provide analysis of detected issues and take the necessary actions to remediate any risks they uncover. Unfortunately, SOC members spend nearly one-third (32%) of their day investigating incidents that don't actually pose a real threat to the business according to a new report…

4 min read

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read