SOARs vs. No-Code Security Automation: The Case for Both

Originally published by The New Stack. Also published by Torq here.

Written by Chris Tozzi, Torq.

Just a few years ago, security orchestration, automation and response (SOAR) was the new buzzword associated with security modernization.

Today, however, SOAR platforms are increasingly assuming a legacy look and feel. Although SOARs still have their place in a modern SecOps strategy, the key to driving SecOps forward today is no-code security automation.

Read on to learn what lightweight security automation means, how it compares to SOAR and why SOARs alone won’t help you stay ahead of today’s security threats.

What Is a SOAR?

A SOAR is a platform designed to help security teams detect, understand and manage their response to security threats.

Over the past decade or so, SOARs have become a key foundational tool for many security teams. That’s due especially to the fact that SOARs solve many of the problems associated with security incident and event management (SIEM) platforms, the old standby tool for security engineers.

What Is No-Code Security Automation?

Just as first-gen SOARs replaced SIEMs, a new category of security tools are replacing, or at least enhancing them. It’s no-code security automation.

No-code security automation refers to tools that anyone – not just security engineers – can use to define risks, enforce security rules and remediate threats automatically. These tools use a codeless (think: drag-and-drop and non-technical) automation approach to security, which allows businesses to manage risks without drawing on specialized engineering expertise.

SOARs vs. No-Code Security Automation

It would be wrong to think of SOARs and lightweight, no-code security automation platforms as being completely distinct types of solutions. SOARs and codeless platforms overlap in the following ways:

• Automation: Both solutions enable automated risk identification and management.
• Efficiency: SOARs and lightweight security tools are designed to help organizations manage risks more effectively.
• Going beyond threat detection: Unlike SIEMs, SOARs and lightweight security frameworks don’t just detect risks and send alerts, they can also be used to manage risk response.
• Threat intelligence: Both categories of tools draw on threat intelligence data to help identify and assess the newest types of security risks.
• Integrations: Both types of solutions can integrate with a variety of systems and environments, which means they can be used almost anywhere – on-premises, in the public cloud, in hybrid cloud environments, in multicloud architectures and so on.

But the similarities stop there. In general, lightweight no-code security automation delivers additional features and benefits that SOARs lack, including:

• Accessibility: Lightweight security automation frameworks are easy enough for anyone to use. In this way, they allow all stakeholders, not just cybersecurity experts, to define and enforce security requirements within the systems they manage.
• Automated response: In addition to making it easy to configure security rules, no-code automation frameworks can automate threat response based on those rules. Traditional SOARs often provide some automated remediation features, but they focus more on orchestrating threat response by cybersecurity professionals than on actually remediating the threat themselves.
• Configuration security posture management: Traditional SOARs usually focus on identifying active risks within environments, not assessing configurations to find flaws that could enable a breach. Lightweight security automation tools do both, however, which means they can address domains like cloud security posture management (CSPM) in addition to runtime security.
• Simple integration: While it’s possible to deploy a SOAR in a variety of environments and with many types of systems, doing so usually requires extensive configuration customizations. In contrast, no-code security automation platforms are designed to start working out of the box, across any mainstream environment, with minimal configuration tweaks.

For these reasons, SOARs increasingly no longer cut it as a standalone security solution. They are subject to too many shortcomings to enable modern SecOps.

SOARs and Lightweight No-Code Security Automation: Better Together

This is not to say that you’re required to ditch your SOAR and replace it with a lightweight security automation platform like Torq. Many businesses that have dedicated cybersecurity teams may opt to continue to use their SOARs as the place where they detect and manage the most complex threats, such as active, targeted attacks by professional threat actors.

But for managing more mundane risks – like blocking phishing emails, securing sensitive data or detecting malicious users – lightweight no-code security automation is a more practical solution. It’s much easier to deploy, and it empowers all stakeholders to support security operations, even at organizations that have minimal cybersecurity resources.

By extension, no-code security automation is the key to thriving in the face of today’s pervasive threats. When you operate in a world that sees 26,000 DDoS attacks and 4,000 ransomware attacks each day, and where threat actors are constantly probing your systems for an open door, you need more agility and automated remediation than a SOAR alone can deliver.

Conclusion

SOARs are great. And if it were still, say, 2015, we’d tell you that a traditional SOAR is all you need.

But it’s not, and we won’t. Lightweight no-code security automation fills the gaps within a SOAR-based SecOps strategy, empowering businesses to build security-centric cultures and to respond to threats as comprehensively and automatically as possible.