Domain 3 of 4 · Chapter 2 of 3

AI Security Automation

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing CompTIA SecAI+ premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • The four links every response workflow runs
  • Choosing where the decide link sits
  • How an orchestration platform assembles a playbook
  • Guardrails that bound an automated action
  • How automation fails, and how fast
  • Measuring an automation programme
  • Exam-pattern recognition for security automation

Where the decide link sits

PropertyAssist onlyHuman-in-the-loopHuman-on-the-loopFully automated
Who selects the actionNobody; the workflow gathers and presentsThe workflow proposes, a named person approvesThe workflow selects and runs it, a person supervisesThe workflow selects and runs it with nobody watching live
When the target system changesNever; nothing outside the case is touchedOnly after the approval is recordedImmediately, before any human has read the caseImmediately, and the case may close itself
What a wrong decision costsAn analyst's reading timeA queue that delays a genuine responseOne wrong action, until somebody reverses itEvery matching event acted on before anyone notices
Guardrail that carries the rungNone needed; no action is takenAn approval gate that takes no action on timeoutA working override plus a notification on every runScope limits, rate limits, an expiry, and sampled review
Fits actions that areAny case, including ones no automation may act onWide, expensive, or reserved to a person by policyReversible but not trivial to undoNarrow, reversible, high volume and well exercised
Evidence you owe afterwardsThe enrichment and where each fact came fromWho approved, when, and on what evidenceWhat ran, and whether a human overrode itWhat ran, plus the periodic review of a sample

Decision tree

Does the action change a system outside the case? Assist only nothing outside the case Irreversible, or wide blast radius? Human-in-the-loop approval gate that takes no action on timeout Does policy reserve the authority to a role? Narrow, reversible, high volume, and exercised? Human-on-the-loop notify on every run, keep a working reversal Fully automated rate limit, expiry, sampled review No Yes Yes No Yes No No Yes Every rung: record what ran, on whose authority, and until when and keep the manual path open, whatever the automation is allowed to do
Cheat sheet

Cheat sheet

  • Every automated response runs four links: trigger, decide, act, record
  • Orchestration coordinates several tools; an automation performs one task
  • Pick the autonomy rung from the cost of being wrong, not the confidence score
  • An approval gate is only a gate if it takes no action on timeout
  • Supervision counts as oversight only with a documented off switch
  • The rung is chosen per action, never per team or per product
  • A procedure nobody has exercised does not run unattended
  • The rule layer decides whether a workflow runs; the playbook layer decides what it touches
  • Give automation rules explicit distinct order numbers
  • Put an end date on any rule created for a temporary situation
  • The unit of authorisation is a group of playbooks, not one response
  • The orchestration platform's identity is not the model's tool credential
  • A model may propose an action and never hold the credential that performs it
  • Rate limits and action logs are damage limitation, not prevention
  • Keep a manual containment path even where automation works
  • Exposure is how wrong the rule is multiplied by how often it fires
  • Name one of the five automation considerations when asked for the drawback
  • One workflow's action is another workflow's trigger
  • Attacker-written case text can reach a connector through the workflow
  • A rule that closes cases without recording why erases its own misfires
  • Override rate is the number that reads the decide link
  • Sample the cases that closed themselves and rework them
  • MTTR already names a repair metric, so write the response quantity out

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. CompTIA SecAI+ (CY0-001) certification
  2. SOAR (NIST CSRC glossary)
  3. LLM06:2025 Excessive Agency, OWASP Top 10 for LLM Applications Whitepaper
  4. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) Whitepaper
  5. Incident Response Recommendations and Considerations for Cybersecurity Risk Management (NIST SP 800-61r3) Whitepaper
  6. Automate threat response in Microsoft Sentinel with automation rules
  7. Automation in Microsoft Sentinel
  8. LLM01:2025 Prompt Injection, OWASP Top 10 for LLM Applications Whitepaper
  9. CompTIA Security+ (V7) certification
  10. Guidelines for secure AI system development: Secure operation and maintenance Whitepaper
  11. Recovery time objective (NIST CSRC glossary)