c3.20 Automate critical playbooks
Security staff are scarce. Automating incident-response playbooks frees them for higher-value work and makes response faster and more consistent. If a task is pure execution rather than judgment, it is a candidate for automation.
Implementation guidance
Automate the "doing", keep the "thinking"
Security people are one of the scarcest resources in any organization. Automating playbook steps lets them focus on judgment while making response faster and more consistent. A good rule of thumb: if a responder is only executing a task rather than thinking about it, automate it. Even code that a human still triggers manually — for example a prepared AWS Lambda function — sharply cuts response time and reduces impact.
Build on managed solutions
- Automated Security Response on AWS deploys, via CloudFormation, a set of Step Functions workflows that remediate common findings (for example CIS baseline non-compliance) and annotate the finding in AWS Security Hub CSPM after remediation.
- AWS Security Hub automation rules let you automatically act on a finding based on its criticality and the affected resource (as it correlates findings from CSPM, GuardDuty, Inspector, and more).
- Amazon EventBridge can route findings to your own Lambda or Step Functions remediations.
Start with your highest-value playbooks
Automate the playbooks you run most often or that are most time-critical first, keep a human approval step for high-impact actions, and log every automated action for audit.
How to validate
- Have you identified the highest-value or most time-critical playbooks to automate?
- Are common findings remediated automatically (for example with Automated Security Response on AWS or AWS Security Hub automation rules)?
- Are automated actions logged, and do high-impact actions keep a human approval step?
Threats addressed
- Manual-only response is slow and inconsistent, and scarce security staff become a bottleneck during an incident — increasing dwell time and impact.
AWS services
AWS Security Hub 
Amazon EventBridge 
AWS Lambda