Simplify your security

operations center
Prioritize efficiency and security with
a unified automation platform
See what’s inside

Page 1 Page 7
IT security is a top concern Simplify your security operations
center with Red Hat Ansible
Page 2
Automation Platform
What is security automation?
Page 9
Page 3
Automation in action:
Automation integrates your security Red Hat Ansible Automation Platform
tools, systems, and processes delivers proven business value
Page 4 Page 10
Security automation is a journey Ready to simplify your security
operations center?
Page 5
Use cases and integrations: Define
your path to security automation
IT security is a
top concern

Security is a leading issue for most organizations, and Security-related tasks can be time-consuming, tedious, and
many CEOs are concerned about cyber threats. This error-prone when human intervention is required. Security
apprehension is not unfounded: 70% of organizations that teams are overwhelmed and understaffed, with the number
have experienced a security breach report a significant or of organizations facing a critical lack of skilled security workers
very significant disruption to business as a result.¹ rising to 53% in 2024, compared to 42% in 2023.¹ The average
cost of breaches associated with a high-level shortage of
Protecting your organization is a critical—but frequently security skills jumped to US$5.74 million in 2024 from US$5.36
daunting—task. Security teams must assemble, maintain, million in 2023, a 7.1% increase.¹
manage, and adapt complex environments using multiple
tools and services from a variety of often-competing However, implementation of automation and AI-based
vendors. The quantity of offerings increases each year, so solutions is on the rise. The number of organizations that use
teams must continually research, assess, and integrate new security AI and automation extensively grew to 31% in 2024.¹
products as the security landscape changes. Wherever AI and automation are applied, they accelerate the
work of identifying and containing breaches. Extensive use of
Additionally, the severity and cost of security breaches AI and automation in key security areas—prevention, detection,
continue to grow. Costs from lost business and post-breach investigation, and response—reduced the average time to
response in 2024 rose nearly 11% over the previous year.¹ identify and contain data breaches by 33% for response and
And the average cost of a data breach jumped to US$4.88 43% for prevention in 2024.¹ Extensive automation and AI
million in 2024, up from US$4.45 million in 2023.¹ usage are also shown to dramatically lower average breach
costs when compared to organizations that don’t use these
technologies in key security areas.¹

Impacts of ineffective security

The number, severity, and cost of security breaches continue to grow.

US$4.88 million 26.2% 1 in 3

The global average cost of a data breach Growth of the cyber skills shortage¹ Share of breaches involving
in 20241 shadow data¹

292 46% US$4.99 million

Days to identify and contain breaches Share of breaches involving customer Average cost of a malicious
involving stolen credentials¹ personal data¹ insider attack¹

¹ “Cost of a Data Breach Report 2024.” IBM, accessed 31 July 2024.

1
What is security
automation?

Security automation involves automating the manual tasks

associated with maintaining the security posture of your business.
It consists of multiple practices, which can be divided into 4
general categories:

Response and remediation

Event-driven activities that involve security analyst
participation, guidance, or both.

Security operations
Day-to-day process- and policy-driven activities
performed on your security infrastructure by
technology teams.

Security compliance Learn more about security

Activities to ensure infrastructure is compliant with compliance and hardening
security policies and regulations.

Hardening Discover how automation can help security

Activities to apply custom security policies to compliance and hardening
infrastructure with the targeted intent and goals. by reading these resources:

This e-book focuses on automating response and remediation • Boost hybrid cloud security e-book
activities and security operations.
• Enhance security with automation: A
Red Hat customer success series

• Use case: Security automation with Red

Benefits of AI and automation for security Hat Ansible Automation Platform
operations, response, and remediation activities

Boost speed and efficiency Increase security at scale Reduce the risk and cost of breaches
Automation streamlines tasks and Applying automation across your security Organizations not using AI and automation
removes the need for manual intervention, infrastructure increases consistency had average costs of US$5.72 million,
accelerating security operations and and allows you to take a more holistic while those making extensive use of AI
allowing staff to refocus on high-value approach to security. Each staff member and automation had average costs of
initiatives. Organizations extensively using can manage more tools, devices, and US$3.84 million, a savings of US$1.88
security AI and automation identified and systems, so you can operate at scale. million.¹ Correspondingly, the use of AI and
contained data breaches nearly 100 days Automation also reduces the risk of automation is on the rise: The number of
faster on average than organizations that human errors, improving accuracy. organizations that used security AI and
didn’t use these technologies at all.¹ automation grew to 31% in this year’s study
from 28% in 2023.
¹ “Cost of a Data Breach Report 2024.” IBM, accessed 31 July 2024.
2
Automation integrates your
security tools, systems,
and processes
Automation success =
people + processes + platform
Maximizing the value of automation
Unite people, processes, and tools with a requires more than just a tool—you also
consistent, flexible platform need to consider your people, processes,
and platform.

• People are at the core of any business

An automation platform can serve as an integration layer between your security
initiative. Participation within and
teams, tools, and processes. A flexible, interoperable platform lets you:
across teams lets staff share ideas and
• Connect your security systems, tools, and teams. collaborate more effectively.

• Collect information from systems and direct it to predefined systems and • Processes move projects within your
locations efficiently and without manual intervention. organization from start to finish. Clear,
documented processes are essential
• Change and propagate configurations with ease from centralized interfaces. for effective automation.

• Create, maintain, and access custom automation content related to your security • An automation platform provides the
tools and processes. capabilities for building, running, and
managing your automation assets. In
• Trigger automated actions across multiple security tools when a threat contrast to simple automation tools,
is detected. an automation platform gives your
organization a unified foundation
Using a consistent automation platform and language across your organization can
for creating, deploying, and sharing
also improve communication and collaboration. When every solution in a security
consistent automation content and
portfolio is automated through the same language, both analysts and operators can
knowledge at scale.
perform a series of actions across products in a fraction of the time, maximizing the
overall efficiency of the security team. And a common framework and language lets
security and IT teams share designs, processes, and ideas more easily, both internally
and across your organization. Read the automated
enterprise e-book

Privileged access Intrusion detection and Secure web Enterprise

management (PAM) prevention systems (IDPS) gateways firewalls

Endpoint protection Security information and Threat intelligence Secure

platforms event management (SIEM) platforms email gateways

Figure 1. An automation platform can connect your security systems, tools, and teams.
3
 Security automation is a journey

Implementing automation in any area of your organization does not happen instantly,
and it is not an all-or-nothing proposition. Security automation is a journey. Each
organization will start—and stop—at different points according to their needs. Those
needs will also dictate the path that each organization takes. Even so, no matter where
you are in your journey, even small security automation efforts can deliver benefits.

Assess your security automation maturity level

Most organizations fall into one of 3 main stages of security automation maturity.
Determining your organization’s current stage will help you adopt the right tools and
processes at the right time to make your automation journey more successful.
Complexity

Opportunistic stage Systematic stage Institutionalized stage

Simplify tasks Centralize processes Orchestrate processes

Scale
Figure 2. Stages of security automation maturity

Stage 1: Opportunistic Stage 2: Systematic Stage 3: Institutionalized

This stage focuses on saving time by This stage focuses on improving This stage focuses on boosting
automating security operations. Common processes and efficiency by adopting a collaboration and integrating security
goals include standardizing security actions cohesive set of security operations tools across your organization. Common goals
across similar devices and technologies and services. Common goals include include creating automated, programmatic
and streamlining manual tasks performed building security processes into higher- workflows that span all aspects of security
across products from different vendors. level workflows and centralizing security and integrating your security and IT
response processes. technologies.

Read the journey to security

automation blog post

4
Use cases and integrations

Define your path to

Common, high-level use cases for
security automation security automation

Each of these use cases can serve as a starting point for

your security automation journey. The key is to start small
and simple, and build over time.

Investigation enrichment

Investigating security alerts and incidents involves collecting information from a variety
of security systems to assess whether a legitimate event has occurred. Information
is typically gathered through a series of user interfaces, emails, and phone calls. This
inefficient process can delay action against threats, leaving your business vulnerable
and increasing the potential costs associated with a breach. Automation allows you
to programmatically assemble information across your security systems, supporting
on-demand enrichment of triage activities performed through security information and
event management (SIEM) systems. As a result, you can assess—and respond to—alerts
and incidents more efficiently.

Threat hunting

Threat hunting involves identifying and investigating potential threats to security in

a proactive fashion. As with incident investigation, staff manually gather and send
information between many systems. Using automation, you can customize and streamline
alerts, correlation searches, and signature manipulation to swiftly examine potential
threats. You can also automatically create and update SIEM correlation queries and
intrusion detection system (IDS) rules to improve detection. Consequently, you can
update your organization’s security defenses more frequently and efficiently to better
protect your business.

Incident response

Incident response involves taking action to stop a breach from continuing. Once a breach
is discovered, security staff must respond quickly and at scale to contain it. However,
response actions often include multiple manual tasks, slowing remediation time and
leaving your organization vulnerable for longer. Automation helps you react faster by
codifying actions into repeatable, preapproved playbooks. You can speed tasks like
blocking attacking IP addresses or domains, allowing non-threatening traffic,
freezing compromised credentials, and isolating suspicious workloads for further
investigation to minimize the damage associated with the incident.

5
Integration is essential Security information and event management
systems collect and analyze security events
to help detect and respond to threats.
Unified automation approaches require integration
Automation can provide programmatic access
between your automation platform and your security
to data sources.
technologies. Essential integrations include:

Firewalls control traffic flow between Privileged access management (PAM) tools
networks, protecting internet-exposed monitor and manage privileged accounts and
applications. Automation can speed policy access. Automation streamlines credential
and log configuration changes. management.

Intrusion detection and prevention Endpoint protection systems monitor and

systems (IDPS) monitor network traffic manage devices to improve their security.
for suspicious activity, issue threat alerts, Automation can simplify common endpoint
and block attacks. Automation can management tasks.
simplify rule and log management.

Learn more

6
Simplify your security operations center

with Red Hat Ansible

Automation Platform

There are many automation solutions available, but not all include
the capabilities needed for effective security automation. Look for
automation platforms that offer:

• A universal, accessible automation language.

A language that is easy to understand and to write allows you
to document and share information between security team
members with different domain expertise.

• An open and unbiased approach.

To be effective, your automation platform must interoperate
with your entire security infrastructure and vendor ecosystem.

• A modular and extensible design.

A modular platform allows you to deploy automation in steps.
Extensibility helps you accommodate additional and future
security tools from other vendors as needed.

7
 Move your security organization
forward with Red Hat

A foundation for building and operating automation services • Chain workflows and playbooks for modular reusability.
at scale, Red Hat® Ansible® Automation Platform delivers
all the tools and features you need to implement security • Consolidate and centralize logs.
automation. It combines a simple, easy-to-read automation
• Support local directory services and access controls.
language with a trusted, composable execution environment
and security-focused sharing and collaboration capabilities. • Integrate external apps using RESTful application
An open foundation allows you to connect and automate programming interfaces (APIs).
almost everything in your security and IT infrastructure,
creating a common platform for participation and sharing Red Hat Ansible Automation Platform also includes tools
across your entire organization. Red Hat Ansible Automation and capabilities to help you optimize your automation.
Platform has also delivered proven outcomes in other areas, Automation Analytics provides insight into how your
including IT and network operations and DevOps. organization uses automation. Automation Hub lets team
A supported set of security-focused Ansible collections— members access certified automation content through a
including modules, roles, and playbooks—is included with the centralized repository. And Content Collections streamline
platform. These assets coordinate the activity of multiple the management, distribution, and consumption of
classes of security solutions for a more unified response to automation assets.
cyber threats and security operations:

Get help from the experts

Red Hat can help you successfully deploy automation faster.

• Red Hat Services Program: Automation Adoption

provides a framework for managing an organization-wide automation
adoption journey.

• Red Hat Training and Certification

offers hands-on training and practical certification to help you use
automation more effectively.

• Red Hat Support

works with you to ensure success on your IT journey. Award-winning
web support gives you access to best practices, documentation,
updates, and security alerts and patches. You can also connect with a
support engineer or technical account manager to resolve issues and
obtain specialized guidance.

• Certified partner content collections

allow you to readily automate hardware and software from a broad
selection of vendors. This trusted, prebuilt automation content is
available through Ansible automation hub and is supported by both the
partner and Red Hat.

8
Automation in action

Red Hat Ansible Automation Platform

delivers proven business value

Red Hat Ansible Automation Platform provides a more efficient, streamlined way to
automate your security operations center. Analyst studies of organizations that use
Red Hat Ansible Automation Platform demonstrate measurable business value. In fact,
IDC interviewed multiple decision makers about their experiences with Red Hat Ansible
Automation Platform and found that study participants gained efficiencies for their
IT teams, and enhanced agility and performance led to improved development and
business results.

668% 61% 27%

3-year ROI² less unplanned downtime, average efficiency,

better resilience² network security
management²

“We chose Red Hat Ansible Automation Platform because we can

achieve efficiency and productivity through better controls, fewer
mistakes, and the scaling and automation.”²

Read the analyst report

² IDC White Paper, sponsored by Red Hat. “The Business Value of Red Hat Ansible Automation Platform.” Document #US51839824, March 2024.
9
Ready to
simplify your security
operations center ?

Automation can help you identify and respond

to growing security threats faster and at scale.
Red Hat helps you protect your business by
connecting your security teams, tools, and
processes with a consistent, collaborative
automation platform.

Learn how to automate security with Red

Hat Ansible Automation Platform:
red.ht/automate-security

Copyright © 2024 Red Hat, Inc. Red Hat, the Red Hat logo, and Ansible are trademarks or registered
trademarks of Red Hat, Inc. or its subsidiaries in the United States and other countries. 10