The last few years have seen a surge of interest in security orchestration and automation (SOA) and how security operations teams can benefit from its adoption. The security orchestration, automation and response (SOAR) market, as defined by Gartner in 2017, evolved from three previously distinct technologies: SOA, security incident response platforms (SIRPs) and threat intelligence platforms (TIPs).

This convergence of three complementary technology areas has magnified the importance of SOAR tools and their increased adoption by security operations teams. In its new market guide, Gartner predicted that, “By year-end 2022, 30 percent of organizations with a security team larger than five people will leverage SOAR tools in their security operations, up from less than 5 percent today.”

A key reason for this growing demand is the pressure on security operations teams to meet an increasing volume of attacks, which are becoming more complex and severe. Gartner points out in the market guide, “As organizations consider threats that destroy data and can result in disclosure of intellectual property and monetary extortion, they require rapid, consistent, continuous and more frequent responses with fewer manual steps.”

Why Are Organizations Adopting Security Orchestration, Automation and Response (SOAR)?

Security teams are adopting SOAR tools to meet key use cases that can deliver short-term benefits. Gartner identified three key areas of security operations decision-making where SOAR tools can add value:

  1. Prioritizing security operations activities
  2. Formalizing triage and incident response
  3. Automating response

All of these areas can reduce the human power needed to operationalize the response process. As noted in the report, “Speed is of the essence in today’s threat landscape,” and organizations that can react quickly in a consistent manner will be best equipped to reduce their time to detect and respond to threats.

The Gartner report also highlighted some important areas for security teams to consider about their deployment and utilization of SOAR tools. The first is that organizations should “prepare for their SOAR implementations by having a starting set of defined processes and workflows that can be implemented.” Gartner also addressed this theme earlier this year in a report titled, “Make Sure Your Organization Is Mature Enough for SOAR.”

Establishing incident response plans and processes is a critical first step toward wider adoption of security automation, and it also forces organizations to consider their current processes to ensure that they are fit for purpose. Every organization has different policies, procedures and technology implementations, so it is sensible to work both with your chosen SOAR vendor’s professional services team and internal resources to review your existing processes and consider what customizations are appropriate to get the highest return on your investment in SOAR tools.

The Future for SOAR

The SOAR market is still emerging. As Gartner noted, client feedback suggests that current use cases are primarily focused on security operations center (SOC) efficiency, allowing analysts to process more incidents and drive response actions much more quickly by enriching security information and event management (SIEM) alerts with threat intelligence and context, and reducing false positives by improving the signal-to-noise ratio.

As clients continue their SOAR journeys, they can look beyond SOC efficiency and consistency gains; Gartner pointed to the potential of using orchestration and automation capabilities for cloud security and nonsecurity use cases.

Access the full report for more information about common SOAR use cases and how your security operations team can benefit today by adopting SOAR solutions, plus recommendations to help you maximize the value of your SOAR deployment.

Gartner, Market Guide for Security Orchestration, Automation and Response Solutions, Claudio Neiva, Craig Lawson, Toby Bussa, Gorka Sadowski, 27 June 2019

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

More from Intelligence & Analytics

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Moving at the Speed of Business — Challenging Our Assumptions About Cybersecurity

The traditional narrative for cybersecurity has been about limited visibility and operational constraints — not business opportunities. These conversations are grounded in various assumptions, such as limited budgets, scarce resources, skills being at a premium, the attack surface growing, and increased complexity. For years, conventional thinking has been that cybersecurity costs a lot, takes a long time, and is more of a cost center than an enabler of growth. In our upcoming paper, Prosper in the Cyber Economy, published by…

Overcoming Distrust in Information Sharing: What More is There to Do?

As cyber threats increase in frequency and intensity worldwide, it has never been more crucial for governments and private organizations to work together to identify, analyze and combat attacks. Yet while the federal government has strongly supported this model of private-public information sharing, the reality is less than impressive. Many companies feel that intel sharing is too one-sided, as businesses share as much threat intel as governments want but receive very little in return. The question is, have government entities…

Tackling Today’s Attacks and Preparing for Tomorrow’s Threats: A Leader in 2022 Gartner® Magic Quadrant™ for SIEM

Get the latest on IBM Security QRadar SIEM, recognized as a Leader in the 2022 Gartner Magic Quadrant. As I talk to security leaders across the globe, four main themes teams constantly struggle to keep up with are: The ever-evolving and increasing threat landscape Access to and retaining skilled security analysts Learning and managing increasingly complex IT environments and subsequent security tooling The ability to act on the insights from their security tools including security information and event management software…