The “Autonomous SOC” Is a Pipe Dream

Like with physical security, humans are still mandatory, even for basic processes. Human/machine collaboration is a necessity for the automation used in global enterprises, especially with regards to security technologies. The classic example of automation technology built for practitioners in security is SOAR; the security equivalent of basic DPA, which effectively automates repeatable processes like sales orders, lead generation, and payroll. It is best used for simple, repeatable systems. But even this can go off the rails without human review such as when employees are automatically offboarded. If checks are not in place to ensure employees that have actually left the firm are offboarded, you could end up in damaging situations…like CEOs losing access or integrity of all their accounts.

Automation is not designed for complex systems that require resilience. Reaping the benefits of DPA requires a simple system, and unfortunately, the SOC isn’t one. The SOC faces very inconsistent inputs in the form of constantly evolving threats, which yields inconsistent outputs. When automation is applied to a complex system made up of unpredictable inputs, it does the opposite of what we come to expect from a simple system – it lowers consistency and quality, and it reduces resilience while increasing the risk of downtime. Imagine an assembly line that starts with the wrong base part – that one little unexpected part can break the whole system.

Each added step to an automation chain limits the scope of applicability. Say your security team wants to set up a SOAR playbook that, in the event of a potentially malicious file executing on a box originating from a phishing email: isolates the endpoint, checks the reputation on Virus Total, confirms the file is malicious, deletes the file, deletes the phishing email across the environment, and blocks the sender of the email. This can be a very advantageous playbook for a security team that regularly faces this issue. However, it limits the scope of applicability, as a series of steps must be met prior to the playbook being triggered. This works fine for consistent inputs, but when inputs are so dramatically inconsistent as in the SOC, with constant new attacks, new technology, and new people, it stops being nearly as effective.

Humans can always outsmart machines. Human attackers do not follow rules of engagement; they identify gaps in security technologies or even attack the security tech itself. In contrast, security tools must follow a set of rules – they are built with an intention in mind, whether it’s to detect threats on the endpoint or to find anomalies in otherwise consistent data. These constraints force a limitation on technology that cannot be overcome without the aid of humans. If an organization uses EDR, an attacker will find a way to bypass it, or not target an endpoint. If an organization collects all logs from every single asset into a SIEM, an attacker will find a vulnerable employee to leverage for covert access. Technology will always be limited by the purpose it was designed for and will always lack the creativity and scope to address every single potential threat.