Security-Scorecard — Customer Success Report

1. Security Awareness & Training Automation

Category: SOC

Subcategory: Phishing sim & awareness

Description: End-to-end automation of the KnowBe4 security awareness program — from enrolling new hires in phishing simulations to tracking training completion, sending reminders, and distributing weekly scoreboards. Metrics collection runs daily to feed operational reporting.

Business Problem Solved: Security awareness programs require continuous administration: creating campaigns for new joiners, monitoring who hasn't completed trainings, and surfacing participation data to leadership. Without automation, these tasks demand recurring manual effort and often lapse.

Integrations: KnowBe4, BambooHR, Slack

2. Phishing Detection & Response

Category: SOC

Subcategory: Phishing detection & response

Description: Automated phishing detection using Expel MDR integrations, Google Workspace email monitoring, and Gmail delivery failure triage. The core Phishing Remediation v3 workflow polls Expel every hour for new phishing investigations and applies automated response logic.

Business Problem Solved: Phishing is the leading initial access vector. Automated, near-real-time investigation of phishing events removes the need for analysts to manually monitor MDR queues and enables consistent, sub-minute response initiation.

Integrations: Expel, Google Workspace, Gmail, Sumo Logic

3. Slack Security Monitoring

Category: SOC

Subcategory: SIEM & log pipeline monitoring

Description: High-volume, real-time Slack message monitoring that screens every sent message for security-relevant keywords. With 11,545 executions in 12 months — roughly 950 per month — this workflow provides continuous visibility into internal communications for threat or policy signals.

Business Problem Solved: Insider threats, data loss, and social engineering often surface first in communication platforms. Automated keyword monitoring enables detection of sensitive terms, suspicious patterns, or policy violations in Slack without manual review.

Integrations: Slack

4. Identity Threat Response & Kill Switch

Category: SOC

Subcategory: Identity threat response

Description: Automated containment of compromised identities. The webhook-triggered KillSwitch deactivates an Okta user and notifies a private Slack channel the moment a compromise signal arrives. A second, broader Kill Switch is available on-demand and extends containment to CrowdStrike endpoint isolation, Google session revocation, and OAuth token deletion.

Business Problem Solved: Mean time to contain (MTTC) for identity compromises directly impacts blast radius. Manual deactivation across multiple systems (IdP, endpoint, SSO) can take 30–60 minutes. Automated containment collapses this to seconds and ensures no step is missed under pressure.

Integrations: Okta, CrowdStrike, Google Admin Console, Slack

5. IT Case Management & SOAR

Category: SOC

Subcategory: Case mgmt & SOAR

Description: Automated handling of Jira-based IT and security tickets. Ticket Resolution Automation polls the IS Service Desk project and applies conditional routing logic to new issues. The Conversationalist responds to Jira webhook events — likely processing ticket updates, comments, or status changes — with intelligent automated responses. A Markdown-to-ADF utility supports Jira-formatted automated comments.

Business Problem Solved: Security and IT teams spend significant time triaging, routing, and acknowledging helpdesk tickets. Automation handles first-touch processing, routing, and conditional responses at scale, letting analysts focus on complex issues.

Integrations: Jira

6. CVE Intelligence & Daily Triage

Category: Vulnerability Mgmt

Subcategory: CVE lookup & remediation

Description: Daily automated ingestion of critical CVEs from the NVD API, cross-referenced with the CISA Known Exploited Vulnerabilities (KEV) catalog, to surface the most urgent vulnerabilities requiring attention. Runs every day at 2 PM Pacific.

Business Problem Solved: Security teams face an unmanageable volume of CVE publications. Automated daily triage that prioritizes critical CVEs against authoritative exploitability data (CISA KEV) enables faster, risk-ranked remediation without manual NVD browsing.

Integrations: NVD API, CISA KEV (HTTP), core.bash

7. Security Metrics & Executive Reporting

Category: GRC

Subcategory: Security metrics & reporting

Description: Automated population and maintenance of security operations dashboards tracking incident metrics (SECINC), security queue metrics (SECQ), cloud vulnerability and issue counts (Wiz), and a monthly executive security dashboard delivered via email. Supporting workflows batch-process Jira tickets and keep hours columns up to date.

Business Problem Solved: Security metrics programs require continuous data collection from multiple systems (Jira, Wiz) and manual aggregation into dashboards. Automating this removes reporting lag, eliminates manual errors, and ensures leadership always has current data without analyst overhead.

Integrations: Jira, Wiz, HTTP Tables, Blink Dashboard, Email (core.emailV2)

8. Identity & Directory Backup

Category: IAM

Subcategory: Identity sync & directory mgmt

Description: Scheduled and on-demand backups of the full Okta identity directory (users, groups, apps) and Google Workspace directory (users, groups, organizational units) to Google Sheets. Monthly snapshots create an auditable historical record of the identity landscape. A BambooHR/Okta cross-reference utility supports reconciliation.

Business Problem Solved: Identity directories are critical assets — accidental deletions, policy drift, or insider changes can be catastrophic without a backup. Automated monthly exports provide a recoverable, auditable baseline for compliance and incident response.

Integrations: Okta, Google Workspace, Google Sheets, Google Drive, BambooHR

9. Network Access Control — Cloudflare Zero Trust

Category: Cloud Security

Subcategory: Cloud access & SaaS policy mgmt

Description: On-demand automation to update Cloudflare Zero Trust team lists with blocked hostnames, URLs, and IP addresses. Each workflow takes a single indicator as input and patches the relevant Zero Trust list — enabling rapid, automated blocklist management.

Business Problem Solved: Manually updating network access control lists in Cloudflare Zero Trust is slow and error-prone. These workflows enable automated or analyst-triggered IOC blocking, keeping network policies current without requiring Cloudflare console access.

Integrations: Cloudflare Zero Trust

10. Endpoint Compliance & Device Management

Category: Other

Subcategory: Endpoint hygiene & MDM ops

Description: Automated endpoint compliance event processing across three MDM/EDR platforms. Kandji and Intune webhook handlers receive device events, match them to user records, and apply conditional logic. On-demand inventory workflows support ad-hoc device audits across Kandji, Intune, and CrowdStrike.

Business Problem Solved: Endpoint compliance gaps — unmanaged devices, policy violations, or new enrollments — need to be detected and actioned quickly. Automated event handlers close the loop between MDM/EDR signals and response actions without requiring analyst intervention.

Integrations: Microsoft Intune, Kandji, CrowdStrike

Strengths

High-volume SOC automation is operational and running at scale. The combination of Slack keyword monitoring (11,545 events), Jira case automation (3,554 events), phishing response (962 cycles), and the KillSwitch (78 deactivations) demonstrates a mature, production-grade SOC automation layer. These are not pilot workflows — they are embedded in daily operations.

Security awareness program is fully automated. KnowBe4 training compliance, campaign metrics, phishing report volume, reminder dispatch, and scoreboard distribution all run on automated schedules. This eliminates recurring manual work and ensures the awareness program operates consistently regardless of analyst availability. New hire campaign creation is also automated via BambooHR integration.

Identity containment with real-world usage. The webhook-triggered KillSwitch fired 78 times in 12 months — roughly 6–7 times per month — deactivating Okta accounts and notifying the security team in real time. This indicates the account compromise detection and containment pipeline is live and being used to respond to real incidents.

Broad integration ecosystem. The library spans MDR (Expel), EDR (CrowdStrike), identity (Okta, Google Workspace, BambooHR), endpoint MDM (Kandji, Intune), ITSM (Jira), security awareness (KnowBe4), CSPM (Wiz), network security (Cloudflare Zero Trust), SIEM (Sumo Logic), and communications (Slack). This breadth reflects a sophisticated security stack being automated end-to-end.

Security metrics program is automated. SECINC and SECQ dashboards receive automated daily data ingestion, and Wiz issues and findings counts are pulled on a consistent schedule. The monthly executive dashboard export and delivery closes the loop at the leadership reporting layer.

Gaps & Opportunities

Cloudflare Zero Trust blocklist workflows are dormant. All three on-demand playbooks for adding hostnames, URLs, and IPs to Zero Trust team lists show zero executions. These may not be connected to automated threat intel feeds or SOAR escalation paths. Wiring these to phishing or IOC enrichment workflows would enable automated network-layer blocking as part of incident response.

Identity Backup coverage is incomplete. Only user exports (Okta, Google) are running on schedule; group, app, and OU backups have never executed. A full directory snapshot — users, groups, apps, and OUs — is the meaningful unit for compliance and recovery. Activating the scheduled backup trigger for the group, app, and OU workflows would close this gap with minimal effort.

Email security monitoring is not active. Both email-based detection workflows (Google Workspace email monitor and Gmail bounce/delivery failure monitor) have zero executions. The Google Risky Login webhook (Sumo Logic) is also inactive. Activating these would extend phishing and account compromise detection into the email layer, complementing the existing Expel-based hourly monitoring.

Endpoint automation depth is limited. While Kandji (94) and Intune (19) webhook handlers are active, the on-demand inventory workflows (Kandji, Intune, CrowdStrike Devices) have never run. The full Kill Switch on-demand workflow — which orchestrates CrowdStrike isolation, Google session revocation, and OAuth token deletion alongside Okta deactivation — also has zero executions. Extending the KillSwitch webhook to invoke this full containment sequence would significantly increase containment completeness.

Intune handler is still in Test Mode. The Intune Catch Hook is labeled "(Test Mode)" and has run 19 times. Moving it to production and removing the test designation would indicate operational readiness.

CVE triage is a single workflow without downstream ticketing. The Daily Critical CVE Triage workflow ingests and enriches CVEs but appears to stop there. Adding automated Jira ticket creation for CISA KEV-matched CVEs would close the loop between vulnerability intelligence and remediation tracking.

Integration Ecosystem Summary