About the Automated Investigation and Response category
What belongs in this category
The Automated Investigation and Response category covers products that take an alert, gather the evidence, decide whether it is real and carry out the response, such as resetting a password, quarantining a file or isolating a device, all without an analyst. Common uses include phishing reports, suspicious sign-ins and malware alerts. Analysts step in only for cases the product cannot settle.
Platforms for building custom playbooks fit Security Orchestration, Automation and Response (SOAR), and AI that investigates each alert as an analyst would fits AI SOC Platform; an AI SOC product that also closes routine alerts without an analyst can enter both. Products that automate one SOC task fit SOC Automation. Any product here may also enter Security Automation or Security Operations, the broad automation and SOC categories.
Related categories to enter
Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the incidents the product resolves: alert types covered, incidents closed each month without an analyst, and customers that rely on it.
- Innovation — an investigation problem solved in a new way, such as reaching a verdict with evidence a reviewer can check, safe response actions that can be undone, or coverage of new alert types without new playbooks.
- Impact — results for customers: share of incidents closed automatically, time to resolve, analyst hours returned, error rate of automated decisions. Give figures from customers.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.