Automate before you buy AI
Jan 15th, 2025 by Jesper Kråkhede
Everyone is talking about AI this winter. Before we get there, let me say something unpopular: most organisations haven´t automated the things they could have automated years ago.
Look at what a SOC analyst does in a typical incident. Check if the user really logged on from that country. Look up the reputation of a file. Isolate a machine. Reset a password and revoke the sessions. Disable an account. Open a ticket. Send a mail to the manager. All of this is repetitive, rule based and well understood. None of it needs AI.
The tools have been there for a long time. Automatic attack disruption in Defender XDR can contain an ongoing attack on its own, disabling a compromised account or isolating a device. Automated investigation and response handles the routine endpoint alerts. Playbooks in Sentinel can enrich an incident, notify the right people and take action. Conditional Access with risk based policies forces a password change when a sign in looks risky, without anyone having to touch it.
So why isn´t it used more? Fear of breaking something, mostly. Start with the safe actions: enrichment, notifications, isolation of normal workstations. Measure the result, build trust and expand step by step.
And here is the point. AI will make automation smarter. But if you don´t have the processes, the playbooks and the trust to automate today, AI will just give you smarter alerts that still wait for a human.
Automate the boring. Then let the clever stuff in.