Notifications
Clear all
Topic starter
11/08/2026 3:10 pm
TL;DR: A lean security team at a major cultural institution cut threat response from days to seconds by automating Okta onboarding fixes, endpoint enrichment, threat blocking, and asset hygiene through Torq, according to Torq. Manual identity and response workflows create avoidable exposure windows that security teams can no longer afford.
NHIMG editorial — based on content published by torq: how a museum moved from manual security operations to automated threat blocking and identity lifecycle management
Questions worth separating out
Q: How should security teams automate MDR response without losing control?
A: Start by mapping specific detections to specific containment actions, then decide which steps can execute automatically and which require approval.
Q: Why do automated workflows create identity risk when visibility is weak?
A: Automated workflows amplify weak visibility because they move decisions faster than manual review can catch errors.
Q: What breaks when endpoint hygiene is treated as admin cleanup instead of security control?
A: Coverage becomes unreliable.
Practitioner guidance
- Measure response latency by control stage Track the time from detection to enrichment to containment for alerts that require API calls, analyst review, and enforcement.
- Automate identity exception handling Build workflows for verification failures, account lockouts, and unlock approvals so identity lifecycle events do not pile up as tickets.
- Continuously clean stale endpoints and duplicates Scan for decommissioned assets, duplicate records, and disabled agents on a scheduled basis and remove or re-enable them automatically when policy allows.
What's in the full article
Torq's full post covers the operational detail this analysis intentionally leaves for the source:
- The exact workflow patterns used to clear Okta lockouts and reduce onboarding friction.
- The step-by-step enrichment chain for suspicious URLs and endpoint events before containment.
- The continuous hygiene logic for stale asset cleanup, duplicate removal, and disabled agent re-enablement.
- The practical examples of how the team embedded automation across SOC and IT operations.
👉 Read Torq's case study on automating SOC, identity, and endpoint response →
Human-speed SOC operations: what changes when identity workflows automate?
Explore further
11/08/2026 3:25 pm
Manual response latency is itself a security failure mode. The story shows that even mature security teams can lose control when review, enrichment, and action depend on humans moving one step at a time. In practice, that creates a hidden exposure window that is longer than most teams realise. The governance lesson is that response latency must be measured as a control outcome, not treated as an operational inconvenience.
A question worth separating out:
Q: Who is accountable when automated identity workflows create an access error?
A: Accountability sits with the team that owns the workflow design, the source data, and the exception path. Automation removes manual handling, but it does not remove governance responsibility. Organisations still need clear control ownership, audit trails, and recovery procedures for failed identity actions.
👉 Read our full editorial: Human-speed SOC operations fail when identity and response stay manual
