---
title: "Phishing: guardsix SOAR Achieving a 77% reduction in time to resolution - guardsix"
description: Leverage guardsix SOAR and achieve a 77% reduction in time to resolution. How? Read this deep dive and find out.
---

[Guardsix Blog | Cybersecurity Research & Threat Intelligence ](https://guardsix.com/blog)

# [Phishing: guardsix SOAR Achieving a 77% reduction in time to resolution - guardsix](https://guardsix.com/blog/phishing-soar-deep-dive)

 Written by [Guardsix](https://guardsix.com/blog/author/guardsix) | Apr 30, 2023 10:00:00 PM

Phishing is a cyber-attack where an adversary [sends fraudulent emails, text messages, or other electronic communication](https://www.guardsix.com/blog/phishing/) to deceive recipients into divulging sensitive information such as usernames, passwords, and credit card details. 

Here we will show how using guardsix has facilitated in drastically reducing time spent on phishing email investigations using [guardsix SOAR](https://www.guardsix.com/product/automation-soar/), the results include:  

- Estimated time savings: **72 days **or **30% **of an FTE per year 
- Estimated over **$80,000** savings/year 
- **33%** of phishing verdicts can be automated 
- Queue time shortened drastically, reducing business risk 

<https://www.guardsix.com/author/logpoint/>

guardsix

Award winning SIEM

  

## **Use Case** 

### **Background and SOAR automation steps** 

When an employee reports an [email as suspicious](https://www.guardsix.com/blog/why-emails-are-such-a-target/), the suspected email is automatically forwarded to the company’s ticketing system, and an incident is created.  

After this, the “Suspected Phishing Playbook” streamlines the review process for emails suspected of being potential phishing attacks, enabling the customer's environment to stay safe from any real malicious threats.  

In this case, the customer expected a verdict match in excess of **75%** between the automated process and the pre-SOAR manual investigation.  

In contrast, for a fully automated response process, the customer expects a verdict match of over **90%**. The customer decided to use [guardsix’s Playbook Design Service](https://guardsix.com/hubfs/blog_assets/playbook-design-service-cvi-2022.pdf) (PDS) to speed up the playbook development process, saving on in-house resources.  

**The PDS suggested the following steps: **

1. SOAR receives the email for investigation 
2. Dissects the email into body and headers for further evaluation 
3. Evaluates each individual characteristic of the email header and scores them accordingly towards a pre-determined risk scale 
4. All URLs are extracted from the email body, and their reputation is fetched using threat intelligence. 
5. SOAR Aggregates all risk scores into a combined severity level score for the entire email 
6. It updates the existing incident in a ticketing system with the analysis details and a conclusion based on the risk verdict. 

## **Data before implementing SOAR** 

The data shows that the company’s number of reported phishing emails is increasing steadily, with 1259 emails reported in November. The customer then splits this into subcategories and tracks the count and time spent on those investigations: 

### The result

| **Resolution of reported phishing** | **Count of Incidents** | **Average Resolve Time Per Incident (Minutes)** |
| --- | --- | --- |
| Spam | 2176 | 213 |
| Phishing | 1461 | 155 |
| Legitimate | 694 | 207 |
| Phishing Campaign | 67 | 68 |
| Newsletter | 42 | 306 |
| Resolved by Caller | 28 | 117 |
| Possible Phishing | 25 | 222 |
| Other | 12 | 399 |
| Grand Total | 4505 | 192 |

In conclusion, without SOAR, the customer spends an average time to resolution of 192 minutes. With an estimated analyst time to resolution of 15 minutes: **The average queue time without SOAR is 177 minutes**. 

## **Following guardsix SOAR implementation** 

After three rounds of iteration on the playbooks, the customer was able to:

1. Achieve over 90% verdict match - **Goal achieved! **
2. Estimated time savings: **72 days or 30%** FTE per year for a single use case:

| **Average Working Time** | **Min. / Incident** | **Incidents per 6 months** | **Total time Spent** |
| --- | --- | --- | --- |
| Without SOAR | 15 | 4505 | 67,575 |
| With SOAR | 3.5 | 4505 | 15,768 |

3. Estimated **$80,000** in savings per year   
4.** 33%** of cases (phishing verdicts) can be fully automated   
5. Queue time shortened drastically, reducing risk to the business   
6. A fully automated playbook can potentially reduce queue time by **3 hours** 

## **Conclusion** 

Security teams face immense pressure, and automating tasks to save their time not only helps them but also makes the business more secure and efficient with its resources. Phishing is just one example of how guardsix SOAR can help. With its exceptional flexibility, guardsix SOAR can support countless use cases, enabling the automation of investigation and response to various cyber threats. 

Want to learn how SOAR can help your organization? Need support in designing efficient Playbooks that fit your organization? Get in touch, and we will guide you through it. 

 

[View full post](https://guardsix.com/blog/phishing-soar-deep-dive)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Guardsix"
  },
  "dateModified" : "2026-03-10T19:54:14.236Z",
  "datePublished" : "2023-04-30T22:00:00Z",
  "headline" : "Phishing: guardsix SOAR deep dive – Achieving a 77% reduction in time to resolution",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1350,
    "url" : "https://logpoint.com/hubfs/Imported_Blog_Media/blog-soar-deep-dive-4-1-2.jpg",
    "width" : 2109
  },
  "mainEntityOfPage" : "https://guardsix.com/blog/phishing-soar-deep-dive",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Guardsix blog"
  }
}
```