Are We Automating Security or Just Automating Alerts?

Over the past couple of weeks, I’ve written about how attackers exploit legitimate identities and trusted IT processes, and why detecting malicious activity after authentication is increasingly important.

That leads to another challenge I’ve seen in security operations. Organizations invest heavily in automation, yet security teams remain overwhelmed by alerts and spend considerable time investigating incidents. The question is what that automation is actually achieving.

Most security teams automate tasks such as forwarding alerts, creating tickets, enriching incidents, and sending notifications. These capabilities reduce administrative work, but moving alerts between queues doesn’t necessarily improve security when analysts still have to piece together the same information manually.

What the Krafton example shows

A Microsoft customer story involving Krafton, the company behind PUBG, illustrates what more effective automation can look like.

By integrating Defender XDR, Power Automate, Security Copilot, and its own AI-based investigation capabilities, Krafton reported alert recognition in under one minute, compared with 15 to 20 minutes previously, and investigations taking approximately three minutes.

The automation supports investigations by gathering evidence, examining related activity, and helping distinguish genuine threats from false positives. Analysts retain control over final response decisions.

Supporting reference: Microsoft Customer Stories: Krafton ↗

Keep response decisions accountable

That’s relevant as vendors increasingly promote autonomous security operations. An incorrectly configured response that disables a legitimate account or isolates a business-critical system can cause significant disruption. Testing, appropriate approvals, and the ability to reverse automated actions remain essential.

Measure the work that improves security

I’m skeptical when organizations measure automation success primarily through playbooks deployed, alerts processed, or tickets closed. Those figures might look impressive on an executive dashboard, but they don’t necessarily demonstrate whether credible threats are being investigated or contained faster.

I’d rather understand whether analysts spend less time gathering evidence, whether investigations are more consistent, and whether response times are improving.

If you’ve invested heavily in security automation but analysts are still doing much of the same manual work, there’s a reasonable argument that you’ve automated the reporting and administration without addressing the underlying operational problem.

As AI-assisted security operations become more common, we need to evaluate these investments against actual outcomes rather than the amount of automation deployed.

The objective should be faster, more consistent investigation and a response process the team can trust.