Security analysts perform the same manual triage steps for every user-reported phishing email: extracting indicators, checking reputation sources and searching mailboxes for copies. Report volumes are rising. What is the MOST efficient way to handle this workload?
Select an answer to reveal the explanation.
Short Explanation
When you're doing the same five clicks a hundred times a day, that's a job for a robot, not another person. Automation takes the repetitive grunt work so your analysts can think. The trap is solving a process problem by just adding headcount or choking off reports.
Full Explanation
Security orchestration, automation and response capabilities execute defined playbooks across tools. For phishing reports, a playbook can extract indicators, query reputation sources, search for matching messages across mailboxes and present the results to an analyst for a decision, reducing handling time and making triage consistent. Analysts then focus on judgment, such as confirming malicious intent and approving removal. Hiring additional analysts spreads the workload but leaves the same manual steps in place, so cost grows in line with volume and errors and inconsistency remain; it is a valid option but not the most efficient. Disabling the reporting button reduces volume by suppressing detection, which removes one of the most valuable early-warning sources and increases risk. Requiring managers to confirm suspicious messages first slows reporting, adds a step with no security expertise and encourages users not to report at all. Exam caveat: automation should follow well-defined procedures, with human approval retained for impactful actions such as deleting messages across the organization. Operational check: confirm the playbook is documented, tested, version-controlled and measured for handling time and accuracy before and after deployment.