SOAR / security automation
Helps withPhishing
Security orchestration, automation and response uses workflows to automatically enrich alerts, open tickets and contain threats.
How it compares
Traditional SOAR platforms are powerful but heavy, and newer automation tools are easier to build with. Compare the number of integrations, how easy workflows are to build and maintain, and the pricing per action.
Why it works
Automation cuts the time between an alert and the response, and it lets a small team handle the volume of a large one.
What to look for
- It should integrate with your EDR, identity and email tools.
- Your team should be able to maintain the workflows without developers.
- Destructive actions should require a human approval step.
Products I track for SOAR / security automation
More in Breach & loss reduction
- DMARC
- Single sign-on (SSO)
- Identity Threat Detection and Response (ITDR)
- Anti-fraud & bot protection
- Cloud Access Security Broker (CASB)
- User & Entity Behavior Analytics (UEBA)
- Account takeover protection
- Secure Web Gateway (SWG)
- Zero-Trust Network Access (ZTNA)
- Dynamic Application Security Testing (DAST)
- Cloud Security Posture Management (CSPM)
- Immutable storage