LinkT&B Editorial Team
When considering AI to reduce security maintenance costs, start with repetitive work such as organizing logs, preparing an initial investigation and drafting reports. Measure AI fees and human review time as well as time saved. Savings must not come at the cost of more missed alerts or incorrect configuration changes.
In this article
- What to measure when comparing maintenance costs
- What is included in a maintenance fee?
- Automating log preparation and report writing
- From an error alert to the start of an investigation
- Who decides when settings should change?
- Which costs can be reduced, and by how much?
- Start with one task, such as a monthly report
- Related article
- Discuss website security and ongoing operations
Installing a security product is followed by ongoing work: checking daily alerts, investigating logs, adjusting settings and preparing monthly reports. Managing several sites can mean repeatedly reading similar records and reformatting them for reporting.
These repetitive tasks are candidates for automation when reviewing maintenance costs. For the websites it manages for client companies, LinkT&B proposes using AI to organize logs, prepare initial investigations and draft reports, with the aim of reducing maintenance work and costs.
Lower costs are not useful if important alerts are missed or recovery takes longer. Which tasks can be automated, and will the benefit justify the implementation cost? The answers depend on how maintenance is actually carried out.
What to measure when comparing maintenance costs
| Area | What to check | Evidence to use |
|---|---|---|
| Organizing alerts | Classify repeated alerts and count occurrences | Check that important alerts remain visible |
| Initial investigation | Collect related logs and change history | Separate possible causes from confirmed facts |
| Configuration changes | Prepare proposed changes and recovery procedures | Have the responsible person assess the impact and approve execution |
| Costs | Outsourcing fees, internal labor and AI fees | Include review, corrections and maintenance of the automation |
What is included in a maintenance fee?
Security maintenance can mean a product help desk, work to make specified configuration changes, or analysis of logs to identify causes and possible responses. Even contracts with the same name may leave investigation after an alert to your own team, or include support from outside specialists.
Start by matching the amount invoiced to the work actually provided. Which monitoring hours, notification methods, investigations, configuration changes and recovery tasks are included? Understanding the conditions for additional charges also helps identify work that automation could reduce.
As one publicly documented example, SCSK’s monitoring service for Prisma Cloud includes alert notifications, monthly reports and responses to inquiries. [1] It covers a different product, but illustrates the tasks involved in ongoing maintenance.
Some of this work is already being automated. SCSK also describes security orchestration, automation and response (SOAR), which connects multiple products and executes response procedures automatically. [2] Before adding AI, check which parts of the current service are already automated so that you do not build the same process twice.
Automating log preparation and report writing
Receiving an alert does not always mean an engineer can immediately investigate the cause. First, they may need to open a management console, retrieve records for the relevant period, compare them with another product’s logs and search for similar past incidents. Reducing this preparation time is one reason to use AI.
APIs and programs can retrieve logs regularly and calculate totals. AI can then help summarize the results, find relevant passages in operating procedures and draft explanations for reports.
| Task | Use of automation and AI | Staff responsibility |
|---|---|---|
| Daily log review | Retrieve records, group alerts for the same event, and detect missing data | Decide which problems need investigation first |
| Initial investigation | Collect related logs, change history and previous responses, and suggest possible causes | Check the original records and investigate the cause and response |
| Handover | Summarize the incident timeline, actions taken and unresolved issues | Decide what to ask the next person to do |
| Monthly reporting | Calculate totals and draft an account of changes from the previous month and actions taken | Check the figures and explanations, and communicate the next steps |
For repeated alerts with the same cause, a summary of when they occurred, how many there were and which pages were affected can reduce review time. But grouping different problems together can hide important details, so retain links back to the original alerts.
Programs should calculate counts and durations from the source data. AI can write an explanation based on those figures, with references to the supporting records. If logs could not be retrieved for a period, say so. AI must not fill the gap by assuming that everything was normal.
From an error alert to the start of an investigation
Consider an example in which error alerts increase after an update to a contact form. The engineer needs to know when the problem began, which action triggers it and what is happening.
An automated process collects traffic logs and change history for the relevant period. AI might summarize them as “Blocking records for a particular submission process increased after the update,” with references to the logs supporting that statement. The engineer checks actual input and records to determine whether the cause is a WAF false positive or an application problem.
This approach can automate the collection of investigation material from several screens. However, an increase immediately after an update does not prove that the update caused it. AI’s suggestions are starting points; a person still checks the actual behavior and logs.
After resolving the problem, record the cause, the changes made and how recovery was verified. Referring to that work when a similar alert arrives can reduce the need to repeat the investigation from the beginning.
Who decides when settings should change?
If a log summary is wrong, a person can reread and correct it. An incorrect setting that blocks traffic, however, may prevent users from accessing the site. The scope of automation should reflect these different consequences.
Initially, limit AI to organizing investigation material and proposing changes. Before adding a WAF exception or blocking traffic, the responsible person should review the affected pages, user impact and rollback procedure. Routine responses can be automated more broadly after repeated testing and clear execution conditions have been established.
The data sent to AI also needs review. Logs can contain form input or authentication-related information. Limit the fields used for analysis, mask personal and other sensitive information, and decide where processing will take place and how long records will be retained. Text received from outside systems must remain data, rather than being executed as instructions to the AI.
Being able to send an alert automatically at night is different from having someone available to restore service at night. Responsibilities for emergency contact and recovery still need to be defined in contracts and internal duty assignments after automation.
Which costs can be reduced, and by how much?
Faster report writing with AI does not reduce the amount paid if the monthly maintenance fee stays the same. To turn time savings into lower expenditure, review the outsourced work and the contract as well.
Potential savings include the labor spent copying logs, organizing similar alerts, calculating regular totals and drafting reports. Product licenses and vendor support fees remain even when those tasks are automated. The specialist analysis and emergency response included in the service also affect its cost.
Before: outsourced maintenance fees + the cost of work performed internally
After: revised outsourcing fees + AI and infrastructure fees + human review and correction + maintenance of the automation
Account separately for initial development and implementation, and parallel operation during migration.
If correcting AI output takes too long, the expected labor savings disappear. During a trial, measure the time through human review and completion, not just AI processing time. Monthly savings and the number of months needed to recover the initial cost provide a clearer basis for deciding whether to proceed.
Automation may also free staff to work on improvements to the site. Distinguish the value of that freed capacity from actual reductions in overtime or outsourcing payments so that the results can be explained clearly.
Start with one task, such as a monthly report
Monthly reporting is a useful first candidate because historical records can be compared with completed reports. Use logs from the same period to generate an AI draft and compare it with the existing report. Are the figures correct? Are important incidents and unresolved issues included? How many minutes did corrections take? Those results help determine whether the process is useful in practice.
The effect of automation is not limited to report-writing time. You can also compare the delay between receiving an alert and starting an investigation, or the effort spent finding the same information at each handover. Expand from tasks where the workload has fallen while checking that important alerts are not being missed.
Another approach is to build up response procedures with specialist support and gradually automate the routine parts. Keep expert involvement for uncertain situations and serious incidents while reducing repeated preparation and recordkeeping. If automation is intended to replace a service that includes 24-hour human monitoring or recovery, those staffing arrangements must be provided separately.
Related article
Protecting Websites and APIs: F5 XC WAAP and Day-to-Day Operations
Discuss website security and ongoing operations
We support website security, monitoring and maintenance. Tell us about your current setup and the daily tasks that are taking too much time.