Security Operations, NDR

Security is about humans, but automation and machine learning is necessary 

An autonomous security operations center (SOC) or autonomous security team of robots is not realistic for the cybersecurity field. But automation and machine learning are critical to the future of risk management.

Allie Mellen of Forrester warned of relying too heavily on automation tactics during an SC Media eSummit on managing extended detection and response.

“We are in a human-to-human fight, and we can’t have machines do a better job than us right now,” said said.

But with so much data for small security teams to sift through, automation and machine learning are needed to help IT teams react and respond faster. 

Automation in XDR is about making recommendations to the analyst, which requires the context around telemetry sources, Mellen said. That tactic can and should be used for response and remediation, she continued, but automation can also help analysts focus on the most critical efforts by removing some of the more manual tasks.

“I think automation is really important because of how much data we have coming in, because of how much we need to understand, because of how quickly we need to make decisions; and we're just unable to do that right now,” Mellen said.

Stephen Weigand

Stephen Weigand is managing editor and production manager for SC Media. He has worked for news media in Washington, D.C., covering military and defense issues, as well as federal IT. He is based in the Seattle area.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.