Jason Chan is one of the world’s foremost cybersecurity authorities and we’re extremely proud to have him as a member of the Torq Advisory Board. He’s a pivotal figure in driving adoption of security automation best practices at many companies, including Netflix, where he led the information security organization.

In our third and final Chan video series, he discusses one of the most important challenges in cybersecurity: making cyberthreat identification, management, and remediation as simple as possible for professionals of all backgrounds and technical abilities.

Chan advocates for getting more people involved in cybersecurity and promoting the concept of interoperability across the security stack. He discusses how Torq reduces the barriers for entry into the world of security automation, and why as a result, it’s a force multiplier for practitioners to deliver the strongest security posture possible and move faster than ever to deliver maximum impact.

Watch the video below and learn more about Chan’s perspectives on Torq:

Take Action Today
Learn how to get started with security automation by reaching out to the professionals at Torq. You’ll learn more about the Torq platform and how we’ve helped myriad organizations achieve and exceed their security goals.

Torq is extremely proud to have Jason Chan on our advisory board. Jason has more than 20 years of experience working in cybersecurity. He’s one of the world’s leading experts in adopting security automation, cloud security, and enhancing security in modern software development practices.

Jason’s most recent career experience was leading the information security organization at Netflix for more than a decade. His Netflix team set the bar extraordinarily high, focusing on cutting edge risk assessment and management, and compliance management strategies and approaches. 

I had the privilege of being able to have a discussion with Jason, exploring the positive impacts security automation is having on organizations of all sizes, worldwide. In the first part of our conversation, “Harnessing Security Automation to Manage the Complexity of Today’s Threat Landscape,” Jason discusses the fact that while cyberthreats are increasing exponentially, it’s becoming increasingly difficult to hire people to address this escalation. As Jason puts it, “The question is how do we get the most out of the resources we have and prioritize the issues we need to address most critically?”

Watch the first part of our conversation in video below and learn all about Jason’s perspective on how security automation addresses these challenges by maximizing the impact of the security systems, processes, and people organizations already have in place, and breaking down security silos:

Take Action Today
Learn how to get started with security automation by reaching out to the professionals at Torq. You’ll learn more about the Torq platform and how we’ve helped myriad organizations achieve and exceed their security goals.

Get Started

Everyone loves automation, and it can be easy to assume that the more you automate, the better. Indeed, falling short of achieving fully autonomous processes can feel like a defeat. If you don’t automate completely, you’re the one falling behind, right?

Well, not exactly. Although automation is, in general, a good thing, there is such a thing as too much automation. And blindly striving to automate everything under the sun is not necessarily the best strategy.

Instead, you should be strategic about what you do and don’t automate. Even if you have the tools and resources to automate certain parts of a process, you may not actually want to automate them.

The Benefits of Automation

To understand the argument for being selective about the processes you automate, let’s go over the key benefits that teams are usually trying to achieve when they automate something. Typically, those benefits include:

• Faster results.
• Less time spent by engineers on manual processes.
• Greater consistency and a lower rate of errors.
• Repeatability.

We could go on, but these bullet points summarize the main goals of most automation projects.

When to Automate and When Not to Automate

Now, if you think critically about how best to pursue the goals we’ve just described, you’ll realize that fully autonomous processes aren’t always the best ways to achieve the goals. Let’s go through each one carefully.

Faster Results

Automation can speed up processes by allowing operations to proceed without waiting on humans to sign off.

The caveat, however, is that if your automation tools run into a situation where they can’t make a decision about how to achieve something – which happens when a variable is introduced that your automation workflow didn’t anticipate – you can end up with more of a delay than you would face if you had a human in the loop to oversee things. You’ll probably get results much more slowly from a fully autonomous process that goes awry than you will from a process where you have a human in the loop to react to unexpected conditions.

Less Engineer Time

By a similar token, the total time that engineers have to invest in operations work may be lower if not all of your processes are completely automated.

The reason why is that if something goes wrong within a fully autonomous process, the response is likely to be highly distracting and time-consuming for your team. But, if you had a human in the loop to begin with, you’d face a lower risk of a disruption that would require an extensive manual response.

Greater Consistency

Automation is a good way to keep processes consistent — so long as those processes are 100 percent predictable and reliable.

But, when there are variables, or when you are dealing with a process where each use case is unique, automation won’t always breed consistency — at least, not the kind of consistency you want. It would be better to keep a human in the loop so that the human could react as needed to special circumstances.

Repeatability

It may be easier to reuse automation tooling, too, when you keep humans plugged into your automated processes.

The reason why is that — once again — each process may be unique, and so you can’t simply lift and shift the automations you’ve created for one process and apply them to a different one. But, if you leave some responsibility to humans, it becomes easier to keep your workflow adaptable enough so that you can use the same automations repeatedly, leaving it to the human to interpret the unique variables within each process and adapt the automations as required.

Using Partial Automation

To illustrate the points above, let’s consider a common process that might seem like a candidate for total automation, but actually is not.

The process is Just In Time (JIT) permissions granting. The goal of JIT permissions is to grant access rights when a user needs them, and revoke them when they are no longer necessary. Having humans configure these permissions each time in a totally manual way is not scalable, so you may think that you would want to automate the process as fully as possible.

But, in reality, it would make more sense to automate only part of your JIT permissions operations. You could automatically collect account and user information, for example, and use these to generate updated access control policies automatically.

But if you actually apply the policies automatically, you run the risk of something unexpected happening with highly negative security consequences. Maybe a user is requesting a JIT permissions update to access a system that was recently moved from testing to production, and that therefore has stricter access requirements. But your automation tooling isn’t aware of that change, so it will grant the permissions without considering the unique circumstances of the request in question.

If you require a human to sign off on the permissions change, however, there is a higher chance that the oversight will be caught. Manual sign-off could delay the process slightly, but the delay should not be significant if the rest of the process is well-automated.

Conclusion: The Limits of Automation

To be clear, we’re not saying automation is a bad thing, by any means.

What we are saying is that there are points within processes where full automation doesn’t always make sense. Although it may seem counterintuitive, there’s value in requiring human participation, even if making processes fully autonomous is a possibility.

In just three quarters since Torq was officially launched, our visionary team has delivered a 385% increase in customers, resulting in 360% quarter-over-quarter growth. We’ve also boosted our headcount by 150% and now have more than 100 technology integration partners, including Armis, Orca, SentinelOne, and Wiz. In addition, we recently opened new offices in the UK, Spain, and Taiwan

Our no-code security automation innovations are paying dramatic dividends for our ever-increasing customer base. We serve organizations of all sizes as they face incredibly challenging, complex, and dramatically-escalating cyberthreats. We’re mitigating those threats at every conceivable incursion point, and emancipating overworked security teams from manual, reactive processes, so they can focus on remediation and response.

I take Torq’s dedication to providing our customers the highest level of protection very personally. I began my career as a technologist and software engineer, then shifted into the world of cybersecurity, and then became an entrepreneur when I co-founded Luminate in 2017 and Torq in 2021. I was inspired by seeing how many earlier industries were revolutionized by automation. 

Back when I began my career as a software engineer, all my software testing was done manually. We had QA engineers repeating the same testing procedures over and over on each and every build of my product to verify it worked correctly. That era is long gone. Today’s modern software development processes benefit from automated QA on multiple levels. Manual testing is exclusively the domain of the most complex and creative tasks, if it’s done at all.

The Security Operations world is now increasingly harnessing the value of automation. Previously, the industry was based on simply delivering “alerts” about potential malicious activity and “reports” on vulnerabilities or misconfigurations, all of which had to be reviewed and dealt with manually. Virtually everyone understands this model is archaic and creates more problems than it solves. 

Both of Torq’s production environments, which include running in the cloud, and our often SaaS-based business line applications, are rapidly evolving. It’s simply not scalable to conduct manual security operations across these complex scenarios. It’s why organizations of all types and sizes are harnessing the potential of automation to ensure continuous compliance and the strongest security posture possible. 

This change is akin to an industrial revolution for cybersecurity and it’s why Torq is experiencing such significant adoption. We’re working with organizations from Fortune 10 goliaths to high-velocity startups and solving major cybersecurity challenges for all of them. They’re all dealing with similar issues as they strive to protect myriad assets from the tens or hundreds of thousands of security events they face daily. Without automation, there simply isn’t a way to effectively mitigate the situation.

I couldn’t be more pleased to see the positive benefits our customers are experiencing. And I couldn’t be more proud of the Torq team that’s so dedicated to pushing the technological envelope. They’re constantly delivering new innovations to make the customer experience as simple, yet powerful and comprehensive as it can be.

We’ve only just begun the Torq journey. I can’t wait to show you everything that’s coming up in the near- and long-term. Our customers and employees represent a true community. It’s our pleasure and privilege to play such an important role in protecting today’s digital-first organizations.