Smarter Week

AI and automation by role

How Security analysts can use AI and automation

Below are 14 common tasks for Security analysts, most common first. For each one you get the best fix (AI, automation, a feature in software you already have, or a simpler process), the steps to set it up and, for AI fixes, a prompt to copy.

Also called: SOC Analyst, Information Security Analyst, Cybersecurity Analyst, Security Engineer, GRC Analyst

Find your own hour leaks, free See the fixes

Task 1 · typically 90 min, every day

Triage security alerts and false positives

Software featureBest fix

Use your security platform's AI to triage and summarize alerts

Microsoft Security Copilot, Google Security Operations with Gemini, CrowdStrike Charlotte AI and SentinelOne Purple AI can investigate an alert, gather context and suggest a verdict, so analysts start from a summary.

Typically saves about 35% of the time2 h to set up
  1. 1Check which AI features your SIEM or EDR license already includes.
  2. 2Turn on automatic alert triage or summaries for your highest-volume alert types.
  3. 3Ask follow-up questions in plain language ("show other sign-ins from this IP in the last 7 days").
  4. 4Track how often you agree with its verdicts before trusting it for auto-closing.

Tools: Microsoft Security Copilot · Google Security Operations with Gemini · CrowdStrike Charlotte AI · SentinelOne Purple AI

One more way to fix it
Automation

Automate enrichment and routine responses with playbooks

Playbooks look up IPs, domains and users, check reported phishing emails and close obvious false positives before an analyst sees them.

Typically saves about 55% of the time6 h to set up
  1. 1Pick the alert type that eats the most time, often reported phishing.
  2. 2Build a playbook in Tines, Torq, Microsoft Sentinel or Google SecOps: enrich, check sandboxes and reputation, decide.
  3. 3Have it auto-close clear false positives, quarantine clear phish across mailboxes, and reply to the reporter.
  4. 4Send only unclear cases to an analyst with the evidence attached.

Tools: Tines · Torq · Microsoft Sentinel playbooks · Google SecOps · Microsoft Defender for Office 365 automated investigation

How to automate this task

Task 2 · typically 30 min, every day

Check emails users report as phishing

AutomationBest fix

Automate enrichment and routine responses with playbooks

Playbooks look up IPs, domains and users, check reported phishing emails and close obvious false positives before an analyst sees them.

Typically saves about 55% of the time6 h to set up
  1. 1Pick the alert type that eats the most time, often reported phishing.
  2. 2Build a playbook in Tines, Torq, Microsoft Sentinel or Google SecOps: enrich, check sandboxes and reputation, decide.
  3. 3Have it auto-close clear false positives, quarantine clear phish across mailboxes, and reply to the reporter.
  4. 4Send only unclear cases to an analyst with the evidence attached.

Tools: Tines · Torq · Microsoft Sentinel playbooks · Google SecOps · Microsoft Defender for Office 365 automated investigation

One more way to fix it
Software feature

Use your security platform's AI to triage and summarize alerts

Microsoft Security Copilot, Google Security Operations with Gemini, CrowdStrike Charlotte AI and SentinelOne Purple AI can investigate an alert, gather context and suggest a verdict, so analysts start from a summary.

Typically saves about 35% of the time2 h to set up
  1. 1Check which AI features your SIEM or EDR license already includes.
  2. 2Turn on automatic alert triage or summaries for your highest-volume alert types.
  3. 3Ask follow-up questions in plain language ("show other sign-ins from this IP in the last 7 days").
  4. 4Track how often you agree with its verdicts before trusting it for auto-closing.

Tools: Microsoft Security Copilot · Google Security Operations with Gemini · CrowdStrike Charlotte AI · SentinelOne Purple AI

How to automate this task

Task 3 · typically 60 min, once a week

Prioritize vulnerability scan findings and chase patch owners

AutomationBest fix

Prioritize findings by real risk and auto-ticket the owner

Instead of working the full scanner list, filter to what is exploitable and exposed, and let the tool open tickets for the owning team with due dates.

Typically saves about 45% of the time4 h to set up
  1. 1Filter findings by known exploited (CISA KEV), exploit likelihood (EPSS) and internet exposure.
  2. 2Map assets to owning teams using tags or your CMDB.
  3. 3Turn on automatic ticket creation in Jira or ServiceNow from Wiz, Snyk, Tenable, Qualys or Rapid7, with SLAs by severity.
  4. 4Report on overdue tickets instead of chasing individuals.

Tools: Wiz · Snyk · Tenable · Qualys · Rapid7 · Jira or ServiceNow

One more way to fix it
Automation

Let Dependabot or Renovate open upgrade PRs, grouped and auto-merged when safe

Bots open small upgrade PRs with changelogs and auto-merge patch updates that pass tests. A coding agent can handle the breaking ones.

Typically saves about 50% of the time1 h to set up
  1. 1Turn on Dependabot (GitHub) or install Renovate.
  2. 2Group minor and patch updates into one weekly PR per ecosystem to cut noise.
  3. 3Enable auto-merge for patch updates that pass CI.
  4. 4For major upgrades, assign the PR to a coding agent to fix breaking changes, then review.

Tools: Dependabot · Renovate · Snyk · Claude Code, OpenAI Codex, Cursor, GitHub Copilot agent mode or Devin Desktop (ex-Windsurf)

How to automate this task

Task 4 · typically 120 min, once a week

Fill in customer and vendor security questionnaires

Software featureBest fix

Answer security questionnaires with AI from your approved answers

Vanta, Drata, SafeBase, Conveyor and Loopio fill in questionnaires from a library of approved answers and policies. A public trust centre stops many questionnaires arriving at all.

Typically saves about 60% of the time3 h to set up
  1. 1Load your policies, SOC 2 report and past answered questionnaires into the tool.
  2. 2Upload new questionnaires and let it draft answers with sources.
  3. 3Review only the low-confidence answers.
  4. 4Publish a trust centre page and send it before customers send a questionnaire.

Tools: Vanta · Drata · SafeBase · Conveyor · Loopio

How to automate this task

Task 5 · typically 90 min, once a week

Collect evidence for SOC 2, ISO 27001 or other audits

Software featureBest fix

Let a compliance platform collect evidence automatically

Vanta, Drata and Secureframe connect to your cloud, identity and HR systems and check controls continuously, so most audit evidence is collected without screenshots.

Typically saves about 60% of the time8 h to set up
  1. 1Connect the platform to your cloud accounts, identity provider, HR system and code host.
  2. 2Map controls to your framework (SOC 2, ISO 27001, HIPAA).
  3. 3Fix the failing tests it shows, and assign owners for manual controls.
  4. 4Give your auditor access to the platform instead of evidence folders.

Tools: Vanta · Drata · Secureframe · Sprinto

How to automate this task

Task 6 · typically 240 min, once a month

Run quarterly user access reviews

AutomationBest fix

Let people request access themselves with approval built in

Access request tools let users ask for an app or group from Slack or a portal, route it to the owner for approval, and grant it automatically, with a full audit trail for reviews.

Typically saves about 60% of the time6 h to set up
  1. 1Pick the tool: Entra ID access packages, Okta Identity Governance, or ConductorOne, Lumos or Opal.
  2. 2Name an owner for each app or group who approves requests.
  3. 3Allow requests from Slack or Teams and set access to expire where sensible.
  4. 4Use the same tool to send quarterly access reviews to owners.

Tools: Microsoft Entra ID Governance · Okta Identity Governance · ConductorOne · Lumos · Opal

One more way to fix it
Software feature

Let a compliance platform collect evidence automatically

Vanta, Drata and Secureframe connect to your cloud, identity and HR systems and check controls continuously, so most audit evidence is collected without screenshots.

Typically saves about 60% of the time8 h to set up
  1. 1Connect the platform to your cloud accounts, identity provider, HR system and code host.
  2. 2Map controls to your framework (SOC 2, ISO 27001, HIPAA).
  3. 3Fix the failing tests it shows, and assign owners for manual controls.
  4. 4Give your auditor access to the platform instead of evidence folders.

Tools: Vanta · Drata · Secureframe · Sprinto

How to automate this task

Task 7 · typically 90 min, once a month

Write incident postmortems and reports

AIBest fix

Draft the postmortem from the incident timeline with AI

The incident channel, alerts and timeline already hold most of the facts. AI can assemble them into your postmortem template so you focus on causes and actions.

Typically saves about 50% of the time10 min to set up
  1. 1Export the incident channel, timeline and key graphs, or use the postmortem draft feature in incident.io, Rootly or PagerDuty.
  2. 2Paste them with your template into an approved AI assistant using the prompt below.
  3. 3Correct the timeline and write the real contributing factors yourself.
  4. 4Make sure every action item has an owner and a date.
Prompt to copy
Using our postmortem template and the incident material below, draft a blameless postmortem for [INCIDENT NAME]. Fill in: summary, customer impact (with numbers only if given), timeline in UTC, detection, contributing factors, what went well, and proposed action items with suggested owners. Mark anything not supported by the material with [CHECK]. Do not assign blame to individuals.

Template:
[PASTE]

Incident channel and timeline:
[PASTE]

Tools: ChatGPT, Claude, Gemini or Microsoft Copilot · incident.io · Rootly · PagerDuty

One more way to fix it
Software feature

Use the AI in your incident and observability tools

incident.io, PagerDuty, Rootly, Datadog and Grafana now summarize incidents, group related alerts and suggest likely causes, which shortens the first confused half hour.

Typically saves about 25% of the time1 h to set up
  1. 1Check which AI features your incident and monitoring tools include (incident.io AI SRE, PagerDuty Advance, Rootly AI, Datadog Bits AI, Grafana Assistant).
  2. 2Turn on alert grouping and automatic incident summaries.
  3. 3During an incident, ask the assistant for recent deploys, related alerts and similar past incidents.
  4. 4Treat its root-cause suggestions as hypotheses to check, not answers.

Tools: incident.io · PagerDuty · Rootly · Datadog Bits AI · Grafana Assistant

How to automate this task

Task 8 · typically 30 min, a few times a week

Research a topic, company or question online

AIBest fix

Use AI research mode and check the sources

Deep Research modes in ChatGPT, Claude, Gemini and Perplexity read dozens of pages and give you a cited summary.

Typically saves about 55% of the time5 min to set up
  1. 1Write the exact question and what you will use the answer for.
  2. 2Run it in a research mode (ChatGPT Deep Research, Claude Research, Gemini Deep Research or Perplexity).
  3. 3Open the two or three key sources it cites and confirm them.
  4. 4Save the summary where your team can find it.
Prompt to copy
Research [QUESTION]. I need this to [DECISION OR USE]. Give me a one-paragraph answer first, then the key facts as bullets with a source link for each, then what is uncertain or disputed.

Tools: ChatGPT Deep Research · Claude Research · Gemini Deep Research · Perplexity

How to automate this task

Task 9 · typically 60 min, once a week

Write PowerShell, Bash or Python scripts for admin jobs

AIBest fix

Have AI write and explain admin scripts, then test them safely

AI writes PowerShell, Bash and Python admin scripts quickly, including Microsoft Graph and Google Admin API calls. Always run them against a test group first.

Typically saves about 50% of the time5 min to set up
  1. 1Describe the job, the platform and the inputs using the prompt below.
  2. 2Read the script and the explanation; ask it to add a dry-run mode.
  3. 3Run it against a test user or group first.
  4. 4Save it in a shared repo with a short README.
Prompt to copy
Write a [POWERSHELL / BASH / PYTHON] script that [WHAT IT SHOULD DO] in [PLATFORM, e.g. Microsoft 365 via Microsoft Graph]. Inputs: [CSV, PARAMETERS]. Requirements: a -WhatIf or dry-run mode, logging to a file, clear error handling, and no hard-coded credentials. Explain each section briefly and list the permissions it needs.

Tools: ChatGPT, Claude, Gemini or Microsoft Copilot · Claude Code, OpenAI Codex, Cursor, GitHub Copilot agent mode or Devin Desktop (ex-Windsurf)

One more way to fix it
AI

Hand well-scoped tasks to a coding agent and review its pull request

Coding agents like Claude Code, OpenAI Codex, Cursor's agent and GitHub Copilot's coding agent can read the repo, make multi-file changes and run the tests. They do best on clear, bounded tasks you can review quickly.

Typically saves about 30% of the time30 min to set up
  1. 1Check which coding agent your company approves and that it has access to the repo.
  2. 2Add a short instructions file to the repo (CLAUDE.md, AGENTS.md or .cursor/rules) with how to build, test and the conventions to follow.
  3. 3Give it a ticket-sized task with acceptance criteria, using the prompt below.
  4. 4Let it run the tests; read the diff as carefully as a colleague's PR.
  5. 5Start with tests, refactors, small features and config changes before larger work.
Prompt to copy
Task: [WHAT TO BUILD OR CHANGE]. Context: [RELEVANT FILES OR MODULES]. Acceptance criteria: [LIST]. Constraints: follow the existing patterns in [EXAMPLE FILE], do not add new dependencies, do not change public APIs unless needed. First read the relevant code and give me a short plan. After I approve, make the change, add or update tests, run the test suite and linter, and summarize what you changed and anything you were unsure about.

Tools: Claude Code, OpenAI Codex, Cursor, GitHub Copilot agent mode or Devin Desktop (ex-Windsurf)

How to automate this task

Task 10 · typically 20 min, every day

Chase tickets that bounce between teams

Process fixBest fix

Publish an ownership map and one intake form so tickets land right first time

Tickets bounce because nobody is sure who owns what. A clear ownership map and a required-fields intake form stop most reassignments.

Typically saves about 35% of the time2 h to set up
  1. 1List the systems and services and name an owning team for each.
  2. 2Publish it where people file tickets, and mirror it in CODEOWNERS and your ticket tool's components.
  3. 3Use one intake form with required fields (system, impact, steps to reproduce).
  4. 4Set a rule: the receiving team reassigns once at most, with a comment, or keeps it.
  5. 5Review the most-bounced tickets each month and fix the map.

Tools: Jira, Linear or ServiceNow · Backstage or a service catalog · Confluence or Notion

One more way to fix it
Software feature

Turn on the AI agent in your service desk to answer and route tickets

ServiceNow Now Assist, Jira Service Management with Rovo, Freshservice Freddy AI and Zendesk AI can answer common questions from your knowledge base in Slack or Teams and route the rest to the right queue.

Typically saves about 40% of the time4 h to set up
  1. 1Check which AI features your service desk license includes.
  2. 2Connect it to your knowledge base and to Slack or Teams so people ask there.
  3. 3Turn on automatic categorization and routing for new tickets.
  4. 4Start with the 20 most common questions and check its answers weekly.
  5. 5Fix or write knowledge articles where it answers badly.

Tools: ServiceNow Now Assist · Jira Service Management with Atlassian Rovo · Freshservice Freddy AI · Zendesk AI agents · Moveworks

How to automate this task

Task 11 · typically 60 min, once a week

Write documents, proposals or long emails from scratch

AIBest fix

Start from an AI first draft, never a blank page

Give the AI your notes, the audience and an example you liked; you spend your time editing, which is faster and better.

Typically saves about 45% of the time5 min to set up
  1. 1Gather your notes, bullet points and a past document you liked.
  2. 2Tell the AI who it is for and what it must achieve.
  3. 3Ask for an outline first, adjust it, then ask for the full draft.
  4. 4Edit for facts and your voice.
Prompt to copy
You are helping me write a [TYPE OF DOCUMENT] for [AUDIENCE]. The goal is [WHAT IT MUST ACHIEVE]. Here are my notes: [PASTE]. Here is an example I like the style of: [PASTE]. First give me an outline. After I approve it, write the full draft. Don't invent facts; mark anything you are unsure of with [CHECK].

Tools: ChatGPT, Claude, Gemini or Microsoft Copilot

How to automate this task

Task 12 · typically 40 min, once a week

Write weekly status updates or reports

AIBest fix

Turn your rough notes into the weekly update with AI

Jot bullet points through the week; AI turns them into a clean update in the format your manager expects.

Typically saves about 60% of the time5 min to set up
  1. 1Keep a running note of what you did and what is blocked.
  2. 2Paste the note and last week's update (for format) into the AI assistant.
  3. 3Use the prompt below and check every fact.
  4. 4Send it or post it.
Prompt to copy
Turn my rough notes into this week's status update. Match the format and length of last week's update. Group by project, lead with results, flag anything blocked and what I need. Do not add anything that is not in my notes.

Last week's update:
[PASTE]

My notes this week:
[PASTE]

Tools: ChatGPT, Claude, Gemini or Microsoft Copilot

How to automate this task

Task 13 · typically 60 min, once a week

Build or update spreadsheet reports by hand

AIBest fix

Let AI build the formulas, pivots and summary

Copilot in Excel, Gemini in Sheets, or uploading the file to ChatGPT or Claude can build the pivot, the chart and the commentary in minutes.

Typically saves about 50% of the time10 min to set up
  1. 1Export or open the data.
  2. 2Ask Copilot in Excel or Gemini in Sheets, or upload the file to an approved AI assistant.
  3. 3Describe the report you want, including the breakdowns.
  4. 4Check the totals against the source before you share.
Prompt to copy
Here is [DESCRIBE THE DATA]. Build a summary that shows [THE NUMBERS YOUR MANAGER WANTS] by [BREAKDOWN], compared with [LAST PERIOD]. Give me the Excel formulas or pivot setup to reproduce it, and three sentences on what changed and why it matters.

Tools: Copilot in Excel · Gemini in Google Sheets · ChatGPT or Claude with file upload

One more way to fix it
Automation

Build the report once so it refreshes itself

Connect the spreadsheet or dashboard straight to the source so next week's report is already done.

Typically saves about 80% of the time4 h to set up
  1. 1List where each number comes from.
  2. 2Use Power Query (Excel), a connected sheet, or a Google Data Studio or Power BI dashboard pulling from the source.
  3. 3Schedule the refresh and send the link instead of an attachment.

Tools: Excel Power Query · Power BI · Google Data Studio (formerly Looker Studio) · Google Sheets connectors

How to automate this task

Task 14 · typically 15 min, a few times a week

Chase people for approvals or sign-offs

AutomationBest fix

Move approvals into a tracked workflow with reminders

Approvals in Teams/Power Automate, Slack Workflows, or your e-signature tool remind people for you and show what is stuck.

Typically saves about 60% of the time1 h to set up
  1. 1List the approvals you chase most.
  2. 2Set up an approval flow (Power Automate Approvals, Slack Workflow Builder, DocuSign or your HR/finance system).
  3. 3Add automatic reminders after 24 hours.
  4. 4Agree a default: no answer in 48 hours means it goes ahead (where safe).

Tools: Power Automate Approvals · Slack Workflow Builder · DocuSign or Adobe Acrobat Sign

How to automate this task

Quick wins

Have you tried…

Have you asked AI to build a spreadsheet formula, pivot or chart for you?
You describe the result you want in plain words, and Copilot in Excel or Gemini in Sheets builds it. ChatGPT or Claude can also analyze an uploaded file.
Have you used an AI "deep research" mode that reads dozens of sources for you?
Research modes in ChatGPT, Claude, Gemini and Perplexity spend a few minutes reading the web and return a summary with links to every source.
Do you start long documents from an AI first draft built on your own notes?
Give the AI your notes, the audience and an example you like. Editing a draft is much faster than writing from a blank page.
Do Dependabot or Renovate open your dependency upgrade PRs automatically?
These bots watch your packages and open small PRs for each update, with release notes. Safe updates can merge themselves when tests pass.
Have you used the AI built into your security tools to investigate alerts?
Security Copilot, Google SecOps Gemini, Charlotte AI and Purple AI gather the context on an alert and summarize it, so you start from a summary instead of raw logs.
Do you use a tool that fills in security questionnaires from your past approved answers?
Vanta, Drata, SafeBase and Conveyor read the questionnaire and draft answers from your policies and earlier responses. You review only the ones it is unsure about.
Have you let an AI notetaker write your meeting notes and action items?
Tools like Copilot in Teams, Zoom AI Companion or Otter join the call, write the summary and list who owes what. You just check it and send.
Have you had AI draft a reply to a tricky or routine email?
You paste the email and say the point you want to make; the AI writes a draft you edit. Outlook and Gmail now have this built in.

HourLeak · the 8-minute work audit

Find out which of these cost your team the most

Each person picks their role, taps the tasks they really do and says how long each takes. The free check gives you your own top fixes; the team scan adds up the hours across everyone and turns them into a 30-day plan.

Take the free check Scan my team, $49

Answers are anonymous. Leaders only see team totals.

More roles in Engineering and IT

Software engineerQA / Test engineerDevOps / Site reliability engineerIT support / HelpdeskIT / Systems administratorAll roles