The last few years have seen a surge of interest in security orchestration and automation (SOA) and how security operations teams can benefit from its adoption. The security orchestration, automation and response (SOAR) market, as defined by Gartner in 2017, evolved from three previously distinct technologies: SOA, security incident response platforms (SIRPs) and threat intelligence platforms (TIPs).

This convergence of three complementary technology areas has magnified the importance of SOAR tools and their increased adoption by security operations teams. In its new market guide, Gartner predicted that, “By year-end 2022, 30 percent of organizations with a security team larger than five people will leverage SOAR tools in their security operations, up from less than 5 percent today.”

A key reason for this growing demand is the pressure on security operations teams to meet an increasing volume of attacks, which are becoming more complex and severe. Gartner points out in the market guide, “As organizations consider threats that destroy data and can result in disclosure of intellectual property and monetary extortion, they require rapid, consistent, continuous and more frequent responses with fewer manual steps.”

Why Are Organizations Adopting Security Orchestration, Automation and Response (SOAR)?

Security teams are adopting SOAR tools to meet key use cases that can deliver short-term benefits. Gartner identified three key areas of security operations decision-making where SOAR tools can add value:

  1. Prioritizing security operations activities
  2. Formalizing triage and incident response
  3. Automating response

All of these areas can reduce the human power needed to operationalize the response process. As noted in the report, “Speed is of the essence in today’s threat landscape,” and organizations that can react quickly in a consistent manner will be best equipped to reduce their time to detect and respond to threats.

The Gartner report also highlighted some important areas for security teams to consider about their deployment and utilization of SOAR tools. The first is that organizations should “prepare for their SOAR implementations by having a starting set of defined processes and workflows that can be implemented.” Gartner also addressed this theme earlier this year in a report titled, “Make Sure Your Organization Is Mature Enough for SOAR.”

Establishing incident response plans and processes is a critical first step toward wider adoption of security automation, and it also forces organizations to consider their current processes to ensure that they are fit for purpose. Every organization has different policies, procedures and technology implementations, so it is sensible to work both with your chosen SOAR vendor’s professional services team and internal resources to review your existing processes and consider what customizations are appropriate to get the highest return on your investment in SOAR tools.

The Future for SOAR

The SOAR market is still emerging. As Gartner noted, client feedback suggests that current use cases are primarily focused on security operations center (SOC) efficiency, allowing analysts to process more incidents and drive response actions much more quickly by enriching security information and event management (SIEM) alerts with threat intelligence and context, and reducing false positives by improving the signal-to-noise ratio.

As clients continue their SOAR journeys, they can look beyond SOC efficiency and consistency gains; Gartner pointed to the potential of using orchestration and automation capabilities for cloud security and nonsecurity use cases.

Access the full report for more information about common SOAR use cases and how your security operations team can benefit today by adopting SOAR solutions, plus recommendations to help you maximize the value of your SOAR deployment.

Gartner, Market Guide for Security Orchestration, Automation and Response Solutions, Claudio Neiva, Craig Lawson, Toby Bussa, Gorka Sadowski, 27 June 2019

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

More from Intelligence & Analytics

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Accelerating security outcomes with a cloud-native SIEM

5 min read - As organizations modernize their IT infrastructure and increase adoption of cloud services, security teams face new challenges in terms of staffing, budgets and technologies. To keep pace, security programs must evolve to secure modern IT environments against fast-evolving threats with constrained resources. This will require rethinking traditional security strategies and focusing investments on capabilities like cloud security, AI-powered defense and skills development. The path forward calls on security teams to be agile, innovative and strategic amidst the changes in technology…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today