Everyone is talking about AI this winter. Before we get there, let me say something unpopular: most organisations haven\u00b4t automated the things they could have automated years ago.<\/p>\n
Look at what a SOC analyst does in a typical incident. Check if the user really logged on from that country. Look up the reputation of a file. Isolate a machine. Reset a password and revoke the sessions. Disable an account. Open a ticket. Send a mail to the manager. All of this is repetitive, rule based and well understood. None of it needs AI.<\/p>\n
The tools have been there for a long time. Automatic attack disruption in Defender XDR can contain an ongoing attack on its own, disabling a compromised account or isolating a device. Automated investigation and response handles the routine endpoint alerts. Playbooks in Sentinel can enrich an incident, notify the right people and take action. Conditional Access with risk based policies forces a password change when a sign in looks risky, without anyone having to touch it.<\/p>\n
So why isn\u00b4t it used more? Fear of breaking something, mostly. Start with the safe actions: enrichment, notifications, isolation of normal workstations. Measure the result, build trust and expand step by step.<\/p>\n
And here is the point. AI will make automation smarter. But if you don\u00b4t have the processes, the playbooks and the trust to automate today, AI will just give you smarter alerts that still wait for a human.<\/p>\n
Automate the boring. Then let the clever stuff in.<\/p>\n","protected":false},"excerpt":{"rendered":"
Everyone is talking about AI this winter. Before we get there, let me say something unpopular: most organisations haven\u00b4t automated the things they could have automated years ago. Look at what a SOC analyst does in a typical incident. Check if the user really logged on from that country. Look up the reputation of a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[110,164,30],"class_list":["post-1468","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-automation","tag-soar","tag-soc"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1468"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1468\/revisions"}],"predecessor-version":[{"id":1521,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1468\/revisions\/1521"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}