Security teams turn to automation to speed incident updates

Automated threat detection and response are increasingly common, with organisations moving towards fully AI-enabled security operations centres in places. Yet the article notes that while automation can cut incident detection to seconds, the communication around incidents remains largely manual, risking strained trust as customers wait for updates on impact and remediation.

Tim Brown, chief strategy officer at Cytaptic, argues that automating communications is important but must be carefully targeted. A centralised view of status and a dedicated crisis-communication platform could speed updates to all stakeholders, including contingency options if normal channels fail. The piece also highlights the human bottlenecks: CISOs juggling multiple teams and the pressure to disclose sensitive information without tipping off attackers.

Douglas McKee of Rapid7 stresses that internal agreement on what is happening and how to communicate it is crucial, especially as third parties may be aware of problems at different times.

On disclosure, the article notes evolving regulatory context under CISA and the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), which could require reporting substantial incidents to CISA within 72 hours of discovery (and 24 hours for ransom payments by critical infrastructure entities).

It discusses language gaps between security teams and business decision-makers, and suggests automation could support incident timelines and stakeholder tracking while leaving final approvals and messaging to humans. The piece emphasises using automation to draft updates from existing responder data, not to replace human verification and release.