Introduction

Security teams are under more pressure than ever. They must manage increasing workloads without growing their teams; stay ahead of threats; and ensure their tech stacks, including AI and automation tools, help them achieve their goals rather than create new obstacles.

This paper captures insights from 900+ security leaders across the United States, Europe, and Australia, uncovering what drives job satisfaction and high performance within security teams. It examines how automation and AI are helping teams tackle increasingly complex challenges and whether teams’ extensive tech stacks simplify or complicate their jobs. It also highlights where teams genuinely succeed with AI, where they feel the technology’s potential falls short, and how automation and AI fit into their plans for a rapidly evolving future.

The Security Operations Center and Its Teams’ Attitudes

Security operation centers are centers of controlled mayhem. When alerts occur, security leaders learn if their tooling and training are aligned to produce positive security outcomes. Security leaders must position themselves and their colleagues for success when the team addresses alerts. This job requires a diverse set of skills, including critical and novel thinking and grace under pressure.

The typical cybersecurity leader is meticulous and devoted. They view their exposure to continuous learning, skills development, and problem solving as positive job characteristics and not points of frustration. Generally, the cybersecurity leader feels satisfied and self-empowered even when facing an expanding digital footprint, the need to integrate new tooling, and an influx of data. In short, while security leaders derive satisfaction from their job, they face an increasing workload.

How many people are on a security team?

The tendency to think of a cybersecurity operation as a large SOC with centrally managed workflows and team members with specialized roles is incorrect. In truth, most cybersecurity teams are smaller. Roughly three in five companies have security teams with fewer than 10 members, with 54.8% managing between 20–49 tools (see Figure 1A).

In what ways is your team working well?

Security operations are under high levels of scrutiny; without this scrutiny, a security team might work in anonymity until a severe error occurs. Cybersecurity leaders hold various perspectives but believe their teams are working well in the following areas:

Which top factors drive job satisfaction for security leaders, and which bring dissatisfaction?

While security leaders consider it a positive attribute that their jobs are subject to changing conditions, they feel slightly misunderstood, as they believe their contributions are not conveyed to other groups within the organization. Conditions such as toxic work environments and poor relationships with their direct managers also seem to affect morale (see Table 1).

Staffing Levels Appear Sufficient, But Workloads Are Increasing

Security operations take place in a necessarily kinetic environment. While workplace experiences are generally positive, workload management remains an area for improvement. A tipping point may be on the horizon, and security automation may hold the key

(see Figure2A, B, and C).

What are the top 5 skills a security leader believes a successful security analyst requires?

Before we present information about the skills security leaders consider requisite for success, we should consider the point of view of such a leader. The security leader is responsible for the tools, architecture, and culture of a business’s cybersecurity. They must find answers to challenges from the ephemeral (e.g., how to block a threat) to the more permanent (e.g., how to return devices/ a network to a state of innocence after a security incident).

Automation accomplishes several important aspects of cybersecurity. First, it combines many of the manual actions a team needs to undertake to investigate an alert, saving time and ensuring accuracy. Second, it consolidates and expedites the response. Last, it presents a powerful technology that allows security leaders to be more tactical and less reactive in their approach to cybersecurity.

Security leaders identified that the most important skills for a successful security analyst involve tactical thinking. The top 3 skills are keeping up to date on threat actors’ TTPs, mastering threat hunting, and understanding malware analysis techniques. These skills relate to different aspects of threat intelligence (TI) and the tactical exploration of a potential attack vector. This makes a great deal of sense, as security operations teams must understand adversary intention and how to contain the blast surface. The next two desired skills security leaders seek out are updating security training and certifications and computer forensics techniques (see Figure 3).

Best Practices in Security Automation

End users, devices, and applications intersect on the network. Applications can be single purpose, but in cybersecurity, many platforms connect to provide visibility. The most common example of how applications and platforms are connected in networks is a security information and event management (SIEM) platform that uses a series of connectors to accept logs from firewalls, NetFlow, endpoint data, cloud instances, and other sources of telemetry. The SIEM indexes and stores data from its ingress and can directly suggest or initiate actions by sending instructions back to these applications.

Security automation binds platforms and improves workflow. It is straightforward and draws on two operative words associated with automation: “automatic” and “autonomy.” Automation means that actions are taken without human intervention. An incident occurs, and the automatic response is to remove all users from the network and require them to reauthenticate back onto the network. This seems like a benign process until it affects several thousand users. Autonomy is the idea that security automation can collect and correlate data without requiring a human to execute on every alert. For example, when an alert is generated in security operations, the security team initiates an investigation into its cause. They will gather when the alert was formally triggered, what devices are likely to be affected, what applications have been accessed, and where an end user or device has traveled on the internet or internal network in proximity to the alert. This is called triage, and a particularly powerful aspect of security automation is the information gathered automatically during triage.

Security automation has been an important advancement toward helping security teams achieve more accurate and faster outcomes. This section describes the attitudes and expectations associated with security automation going forward.

What tasks would security leaders like to see automated?

There is a direct correlation between the activities that security leaders are spending the most time on and those they most wish to automate. Respondents indicated that network security is the top task they would prioritize for automation, followed by threat detection and cloud security (see Figure 5).

Which challenges could the right automation solve?

The question of which challenges the right automation could solve relates to that of which tasks are the top priorities for automation. Time spent on manual tasks is the most frequently mentioned challenge, but streamlining data is also important. Security leaders suggest there is too much data and not enough information and that there are too many alerts and logs (see Figure 6).

Business Orchestration and Automation Technology

Hyperautomation and business orchestration and automation technologies offer solutions that not only help security teams strengthen defenses but also improve collaboration between security and closely knit business units, such as IT and DevOps. support for custom code among others.

Security leaders find immense value in various IT functions that automation could improve. Roughly 83% of security leaders thought automating coding was a good idea or were very enthusiastic about the prospect. However, the prospects of monitoring IT and security shared responsibility (patch management, installing firewall rules, etc.) were met with the most enthusiasm (see Figure 8). IDC believes that this indicates silos still exist between the network operations center and SOC.

How would security teams reallocate time that automation saves?

In security operations, extra time is something of a rarity. Security teams prioritize reallocating time toward security policy development, training, and team development as well as incident response planning over other worthy activities (see Figure 9).

The Expanding Role of AI in Cybersecurity

Artificial intelligence has been a part of cybersecurity since the beginning of the 21st century. A close cousin to AI, machine learning has been used in IT, security, and operational platforms for two decades. User behavioral analytics (UBA) establishes baseline behaviors and creates alerts when deviations occur. Implemented a decade ago, this was a discrete standalone technology but has been integrated into almost all cybersecurity detection and response systems.

AI is a very broad term, and it could include UBA and basic machine learning. For the purposes of this paper, AI refers to the adoption of GenAI and agentic AI and how cybersecurity leaders perceive these technologies.

Security Teams’ Most Common AI Tasks

Summarizing security data and threat intelligence are the most common AI use cases for security data. Level 1 triage, advanced triage, and EDR are standard features within detection and response platforms, as security appliances assimilate data around the MITRE ATT&CK framework.

Summarizing security data is a valued use case for security leaders. Modern businesses may ingest petabytes of data, and finding security context from this constant ingestion is impossible to achieve manually. Aggregating data from disparate sources such as NetFlow, Syslog, and firewall logs is difficult because these are all received in different formats. In addition to security logs, there are endpoint logs. Last, TI analysis is a classic problem for the SOC, as information about threats, tactics, and procedures may not be tailored to one’s own business environment (see Figure 12).

How do security leaders view the current AI adoption level?

It may be reassuring that the most common response to this question was that security leaders were ultimately optimistic about AI, but they have concerns. Training is the top concern; this is exacerbated in the SOC, where operations are at the point of attack. Businesses struggle to allot time off the front line.

AI adds capabilities, but it also adds governance layers. One-quarter of respondents suggested that AI is not properly leveraged for security (see Figure 19).

Advice and Recommendations

Returns from real-world implementations have dampened the initial unbridled enthusiasm for AI. Return on investment has been hard to prove, as implementing AI for business use cases is not always an intuitive process. For cybersecurity, none of this is particularly new. Cybersecurity leaders have gone through similar cycles in machine learning and user behavioral analytics.

The adage that cybersecurity is the combination of people, processes, and technology is as relevant as ever. While it is tempting to suggest that human beings are the weakness in the loop (audacious in so much as a human is writing this and other humans will read it), humans provide resiliency and redundancy as problems with data mining and interpretation and economies of scale work themselves out.

• Security leaders are realistic about AI.
  Security leaders expressed very little trepidation about AI in security environments. By its nature, security operations is an evergreen profession where AI automation can help redistribute the gift of time, allowing staff to focus on training or prevention planning rather than manual tasks.
• Failing to plan is planning to fail.
  A security operations team should chart out security automation objectives. For instance, they could decide to automate 80% of all security responses.
• In AI adoption, it is better to be right than to be a first adopter.
  When working with GenAI, starting with modest data sets and learning what works before expanding the model seems preferable to presenting massive data sets and asking GenAI (and soon agentic AI) to simply model the data sets to the best of its understanding.
• Security automation can prevent errors as well as provide a perfect conduit to maximize the utility of AI.
  When it is undertaken correctly, security automation creates a lossless tunnel between applications. Automation serves as a boundary and perimeter for AI functions.
• While there are outsized expectations for AI in cybersecurity, there are also outsized responsibilities.
  The regulatory environment is unsparing. If a data breach compromises the sovereignty of digital citizens, the regulator won’t care if AI caused it, and neither will a business’s customers. While AI creates efficiencies and generates unique insights, the data must remain pristine. Best-in-class data access and data protection techniques are required to realize the promise of AI.