The SOC wants leadership buy-in for more playbook automation. Which statement best captures the security-operations benefits?
Select an answer to reveal the explanation.
Short Explanation
Automation is a force multiplier: same small SOC, faster repeatable moves, baselines that do not drift because someone was tired. It does not make humans or budgets magically disappear.
Full Explanation
Security-operations automation earns leadership buy-in when framed accurately: it improves efficiency on repetitive tasks, enforces baselines consistently without fatigue-driven drift, speeds reaction to alerts, and multiplies the capacity of a limited municipal SOC workforce. Playbooks that enrich alerts, isolate hosts, or open tickets let a small team cover more ground with more repeatable quality—not because humans disappear, but because machines handle the rote steps humans should not retype under pressure.
Claiming automation always eliminates the need for any human analysts permanently oversells and ignores judgment, tuning, and complex investigations. Guaranteeing zero false positives and zero tooling cost is false; automation can amplify bad detections and carries license/maintenance cost. Saying automation only helps marketing websites, never security operations, ignores SOAR, provisioning, and detection-response tooling central to modern SOCs.
Exam caveat: automation is a force multiplier under governance—poorly scoped playbooks can mass-disable accounts or isolate the wrong hosts. Benefits statements for leadership should pair with metrics (MTTD/MTTR, consistency) and risk controls.
Operational check: pilot a narrow playbook (for example critical-alert ticketing or approved host isolation), measure time saved and error rates versus manual handling, document residual human approval points, and present those results when requesting broader municipal SOAR investment.