What must be automated to enhance the efficiency of a security team response?

Automation of containment and response actions—such as isolating compromised endpoints and applying predefined security policies—is a critical capability of Cisco’s XDR and SecureX platform. According to SCAZT Section 6: Threat Response (Pages 112–117), automating threat containment allows security teams to rapidly limit the blast radius of incidents and improve mean time to respond (MTTR), without relying solely on manual intervention.