RSAConference 2022 USA hit the nail on the head with this year’s theme: Transform. The global pandemic has transformed every aspect of our lives – from online learning to remote work to contactless commerce, to name a few. Organizations had to move fast to adapt and keep their businesses going. In fact, Microsoft reported seeing two years of digital transformation in the first two months of the pandemic. More recently, the CIO of the Social Security Administration said, “The first 10 months of the pandemic brought on about 10 years’ worth of acceleration of business modernization.”

Not only did organizations have to transform business processes to deliver goods and services in an increasingly digital world, but they also had to transform their security operations center (SOC) to better protect against a surge in attacks aimed at disrupting this uncharted territory. As COVID began to spread around the globe, security leaders experienced a spread of reports and alerts warning of a rise in attacks against schools, healthcare organizations and companies in other critical infrastructure sectors. Research now reveals that during the pandemic, 81% of global organizations experienced cyber threats, with 79% experiencing downtime due to a cyber incident.

In turn, SOCs are accelerating their transformation to become detection and response organizations. Given the shortage of security personnel and the need to move fast, security leaders realize that automation is key and are considering product categories including Security Orchestration, Automation and Response (SOAR) platforms and tools and Extended Detection and Response (XDR) solutions. These solution categories can help because they focus on defining processes and automating steps needed to complete that process. This approach works fine if you’re in a static environment doing the same thing over and over again. But in detection and response, which is dynamic and variable, that’s not the case. You need to think differently about how and when you apply automation.

Data-driven automation, not process-driven
The challenge is that when applied to detection and response, process-focused playbooks are inherently inefficient and complex because the decision-making criteria and logic are built into the playbooks and updates need to be made in each playbook. This complexity grows exponentially as you increase the number of playbooks. 

At ThreatQuotient, we have long believed that data is the lifeblood of detection and response automation. That is why data-driven playbooks are required, where the data, or information, should drive playbook initiation and data learned by actions taken is at the core of everything. We also believe that automation is more than just running processes. It involves inputs and outputs to processes as well to cover the full security lifecycle.

To eliminate the complexity inherent in traditional playbooks and drive all aspects of automation, ThreatQ TDR Orchestrator takes a data-driven approach across all three stages of automation:

1. Initiate: Define what should have actions taken upon it and when those actions should occur
2. Run: Perform the course of action or defined process through to completion 
3. Learn: Record what is learned for analytics and to improve future response

I’d like to invite you to meet with us at RSAC for a demo of ThreatQ TDR Orchestrator. See how you can reduce playbook runs by as much as 80%, ensure output is relevant and high priority and learn from the actions taken to improve over time. Whether you choose to use ThreatQ TDR Orchestrator to complement other playbook capabilities through our ecosystem partners or decide to define data-driven playbooks within the ThreatQ platform, we believe you’ll be pleased with the results. 

We hope to see you in San Francisco!