Moving towards fully autonomous security systems within a business is a “pipe dream”, according to a senior analyst at Forrester.

Allie Mellen said that security vendors’ pursuits of an autonomous security operations centre (SOC) are not possible as there will always need to be a human element involved.

Mellen commented that hopes of creating an all-in-one product to fully automate the functions of a security team would be almost impossible to implement due to technical and logistical limitations.

She argued that, although automation has been instrumental in transforming certain business areas, and remains powerful for security applications, security complexity means a machine could never fully protect against their various techniques.

Threat actors tend to be highly unpredictable in their methods, meaning that anticipating the next move in any engagement would require a well-trained human mind, she said.

“In contrast, security tools must follow a set of rules – they are built with an intention in mind, whether it’s to detect threats on the endpoint or to find anomalies in otherwise consistent data,” Mellen said in a blog post this week.

She added that security systems still demand a certain degree of human oversight, and always will, especially with complex environments in which automated systems could “go off the rails”.

“These constraints force a limitation on technology that cannot be overcome without the aid of humans. If an organisation uses endpoint detection and response, an attacker will find a way to bypass it or not target an endpoint,” she said.

“If an organisation collects all logs from every single asset into a security information and event management system, an attacker will find a vulnerable employee to leverage for covert access.”

Theoretical upsides to fully automated SOCs and security orchestration, automation, and response (SOAR) solutions include the reduced impact of cyber skills shortages on organisations and fewer data protection weak points among employees, but human decision-making is still required for the best protection.

Although move to a fully automated security system is unlikely to be possible, as Mellen suggested, there is an argument to be made that implementing a certain degree of automation to the process could have meaningful benefits for IT professionals.

Earlier this week, a report from Axiad highlighted a critical barrier to optimising an organisation’s cybersecurity posture: internal IT complexity that often forces authentication to be done in silos.

The results of Axiad’s 2022 Authentication Survey showed that executives have their hands full managing the underlying complexity of their authentication practices.

According to the survey, 70% of security and IT professionals are overwhelmed by complexity related to authentication, showing a growing requirement to provide them with help.

Recommended

Recent research from Mimecast has also noted the impact of mental health on cybersecurity professional after suffering from a cyber-attack.

Around two thirds of professionals working in cybersecurity have had their mental health impacted, showing an increased need to further support people working in IT fields.

Ransomware attacks have soared over the last couple of years, exhausting cybersecurity professionals around the world. There could be a place here for a degree of automation to carry some of the burden.

Businesses can become more vulnerable to cyberattacks after one has taken place, which often leads to cybersecurity employee stress, burnout and potentially quitting the workforce.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.