The 25 Percent Ceiling: Where SOAR Automation Actually Delivers in IR
18.09.2026 soarautomationincident-responsecontainment
Few words get thrown around SOC procurement decks in 2026 as liberally as “automation.” What actually happens under the hood, though, looks very different from the vendor slides. One recent comparison puts it bluntly: SOAR’s real-world automation rate sits around 25% because every novel threat needs a new playbook. Three-quarters of cases still end up with a human — not because the tooling is bad, but because classic SOAR playbooks are, at their core, static if-then logic.
The Automation Spectrum: Four Levels, One Hard Ceiling
The evolution can be described as a spectrum running from manual enrichment to autonomous containment. One analysis sums up the sober reality behind it well: the real value of automated response doesn’t sit at Level 3 — despite that being what most agentic SOAR vendors are selling in 2026 — but at the boundary between Level 1 and Level 2, where cases analysts already handle identically every time get fully automated, rather than novel, judgment-heavy investigations. The key question isn’t “automated or not,” but which properties a case needs before automation is even safe: the decision must be deterministic, the data reliable, the action reversible, and a wrong call must have a contained blast radius — examples include phishing email quarantine when a sender domain matches a threat intel blocklist, automatic account lockout after a brute-force login threshold from a non-corporate IP, and blocking a hash confirmed malicious by two or more sandbox verdicts.
For IR teams, this means building elaborate SOAR playbooks for complex, multi-stage ransomware chains optimizes the wrong end of the problem. The real leverage sits in the sheer volume of routine cases — not in the edge case that requires human judgment anyway.
Identity Becomes the Primary Automation Surface
A second shift is moving classic containment automation away from the endpoint. Identity becomes the primary automation surface: with identity weaknesses implicated in nearly 90% of modern intrusions, automated IAM response — session revocation, credential rotation, step-up authentication — will eclipse endpoint-centric containment as the default action. This matches the operational experience of many recent incidents where isolating a device does little once an attacker already holds a valid session.
The effect is measurable. A January 2026 analysis of hundreds of incidents delivers concrete numbers: a study of 630 incidents by Eye Security found that managed detection and response environments reduced BEC dwell time from 24 days to under 24 minutes — a 99.9% reduction. Hours of analyst work per incident dropped from 19 to 2. End-to-end ransomware handling took 39 hours in MDR-enabled environments compared with 71 hours without. Numbers like these explain why containment automation is no longer optional — but they don’t imply every piece of automation is equally sound.
What This Means for IR Playbooks
Rather than tuning SOAR toward “more automation” across the board, IR teams should evaluate each MITRE ATT&CK technique individually and tie it deliberately to compliance obligations: SOAR should be mapped to NIST SP 800-61’s Detection and Containment phases, XDR to detection across telemetry layers, and for each technique a specific response action should be automated and connected to a compliance trigger — such as the SEC 8-K four-day disclosure clock or NIS2’s 24-hour early warning. Skip that mapping, and you end up with automation that works technically but stays blind regulatorily.
The real maturity question for 2026 isn’t “how much do we automate?” but “which 25 percent of our cases are genuinely automatable — and how do we make sure the remaining 75 percent reach the right humans faster?” That’s where it’s decided whether SOAR actually saves time in daily IR work, or just becomes one more console nobody has the bandwidth to watch.
← Back to overview