Every security team drowns in the same work. Someone pulls the overnight findings. Someone checks the cost anomalies. Someone assembles the weekly report that three people skim and nobody remembers. It's necessary, it's repetitive, and it quietly eats the hours you wanted to spend on the things that actually require a brain.
So automate it. That part isn't controversial. What's worth getting right is the line between what you hand to a machine and what you keep for a human — because teams tend to draw it in exactly the wrong place.
The instinct, once automation starts working, is to push it toward the high-value decisions. Let the system decide whether this is an incident. Let it decide whether to escalate. That's the trap. The high-stakes, ambiguous, consequence-heavy calls are precisely the ones that need human judgment, context, and accountability. Automating them doesn't save your best people time; it removes them from the moments that matter most.
Here's the heuristic I use. Automate the work that is repetitive, well-defined, and low-variance: gathering, summarizing, correlating, the recurring what-changed-overnight sweep. Keep for humans the work that is rare, ambiguous, or carries real downside if it's wrong. Automation in security doesn't replace judgment. It clears away everything around judgment so your scarce attention lands where it's irreplaceable.
Do this well and the payoff isn't a smaller team. It's a team that spends its day on the 5% of work that genuinely needed them, instead of the 95% that didn't. In a field where attention is the actual bottleneck, that's the whole game.