Both rows start from the same alert (a phishing email / malicious process on an endpoint) and run the same four-stage response — only the executor differs:
- Manual — a SOC analyst performs each step by hand: looking up IP reputation, isolating the host, blocking the sender, then writing up and notifying the team. Each step is bottlenecked by a human, so durations are drawn in minutes.
- SOAR — a pre-built playbook calls each tool's API automatically (threat-intel, EDR, firewall) with no wait for a human, so the same steps take seconds. The analyst is looped in only at the end, to approve the already-assembled context.
- MTTR — Mean Time To Respond — is read straight off each row's finished run and the speed-up is the ratio between them, illustrating why SOAR adoption compresses incident response from hours to seconds.