A security team at a 2,000-person company gets about 300 user-reported phishing emails a week. Each one takes an analyst around ten minutes: pull the headers, check the links, search for other copies, reply to the person who reported it. That is 50 hours a week of the same steps in the same order, and most of the messages turn out to be ordinary marketing.
Work like that is what automation is for. On the CompTIA Security+ SY0-801 exam it sits under objective 4.6, which expects you to apply automation and orchestration to secure operations in a given scenario: to recognize which tasks are worth automating and what a sound automated solution looks like. This lesson covers the main use cases, provisioning, desired state management, anomaly detection and ticket management, then walks through a stale-account script and a phishing triage playbook. The guardrails that keep automation from causing harm are the subject of the next lesson.
Automation runs a task; orchestration runs the whole sequence
Scripting, automation and orchestration are related but not interchangeable, and an exam answer can turn on the difference.
Scripting is writing the instructions: a PowerShell, Python or Bash file that performs steps a person would otherwise type. Automation is a machine carrying out a task without a person driving each step, triggered by a schedule, an event or a button. A script that runs nightly and disables expired contractor accounts is automation.
Orchestration coordinates automated tasks across different systems into one workflow, in order, with decisions between the steps. Pulling a file hash from the EDR console, checking it against threat intelligence, opening a ticket and isolating the host only if the verdict is malicious is orchestration: four tools act in sequence, and the path depends on what each one returns.
The platform built for this is SOAR, short for security orchestration, automation and response. It has connectors for the tools a SOC already runs (SIEM, email gateway, EDR, firewall, identity provider, ticketing) and executes playbooks: defined workflows that start on a trigger and end in a documented outcome. Some teams reserve "runbook" for the step-by-step procedure behind a single task. Vendors use both words loosely, so read what a question describes rather than its label.
The SIEM collects and correlates events, as covered in the monitoring section, and SOAR acts on what the SIEM finds. When a scenario says alerts are detected but the team can't keep up with the response work, the answer points to SOAR, not a second SIEM.
Provisioning automation ties every account and resource to a source of truth
User provisioning is the classic first automation project. Done by hand, a new hire's access depends on someone reading an HR email and clicking through four consoles, and a leaver's access depends on someone remembering to remove it. New staff wait days, and former staff keep working credentials for weeks.
Automated provisioning makes one authoritative system, usually the HR platform, the source of truth. A hire triggers a workflow that creates the directory account, assigns groups from the role's template, creates the mailbox and pushes the account into SaaS applications, often through SCIM (System for Cross-domain Identity Management), the standard API for provisioning cloud app accounts. A transfer removes the old role's groups as well as adding the new ones, which stops privilege creep. A termination disables the account and revokes sessions and tokens within minutes. Every account built from a template matches its peers. The identity life cycle itself is covered in the identity and access management section.
Resource provisioning applies the same idea to servers, cloud instances, storage and network objects. A template or infrastructure-as-code definition builds the virtual machine with the approved image, hardened configuration, correct network segment, logging turned on and tags naming its owner and data classification. Automated deprovisioning matters as much: cloud accounts where test resources are never torn down fill with forgotten instances, open storage buckets and unpatched hosts nobody owns. A scheduled job that flags untagged resources and shuts down those past their expiry date, after warning the owner, closes that gap.