A city CIO confuses SOAR orchestration with simple scheduled scripts for password resets. What terminology distinction should security leaders teach?

A city CIO who confuses SOAR orchestration with simple scheduled scripts for password resets needs leaders to teach the distinction between orchestration platforms and simple scheduled scripting. A cron-style reset job is narrow, often single-system automation. A SOAR platform coordinates multi-step playbooks across ticketing, enrichment, chat, EDR, and approvals with logging, branching, and human gates. Civic stakeholders who fund "automation" must share vocabulary so budget and risk conversations do not treat every script as a platform—or every platform as a toaster-level cron.

Why the other options fail by concept: Distinguishing orchestration playbooks from scheduled SIEM reporting for civic stakeholders misses the CIO's actual confusion; orchestration playbooks actively execute coordinated multi-tool actions with branching, enrichment, and approvals, while scheduled SIEM reporting only generates timed summaries from collected logs, not simple scheduled scripting for password resets. Distinguishing orchestration platforms from automated password vault rotation for civic stakeholders is too narrow for this question; automated vault rotation is a specific credential-cycling function for storing secrets, while the CIO confuses generic simple scheduled scripting like a cron password reset with orchestration platforms that coordinate multi-step playbooks across tools with logging, branching, and human gates. Distinguishing orchestration platforms from simple ticketing queue automation for civic stakeholders addresses the wrong automation; ticketing queue automation only routes, prioritizes, and tracks tasks, while orchestration platforms actively execute coordinated response actions across ticketing, enrichment, EDR, and approvals, and it does not teach the script-versus-platform distinction the CIO needs.

Exam caveat: Some lightweight orchestration can live outside a commercial SOAR product; the distinction is capability and governance, not the brand name on the invoice. Operational check: inventory civic automation into scheduled scripts versus multi-tool orchestrated playbooks, document the difference for the CIO, and require purchase justifications to state which class of problem is being solved.