# A Multi-Vocal Review of Security Orchestration

arXiv: https://arxiv.org/abs/2002.09190 · HTML: https://mlsanity.com/paper/2002.09190/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Feb 2020.

## Built on by (most cited first, 9 of 9)

- [From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration](https://mlsanity.com/paper/2603.04474/) (2026)
- [Motivations, Challenges, Best Practices, and Benefits for Bots and Conversational Agents in Software Engineering: A Multivocal Literature Review](https://mlsanity.com/paper/2409.11864/) (2024)
- [LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations](https://mlsanity.com/paper/2604.05440/) (2026)
- [Testing Individual Fairness in Graph Neural Networks](https://mlsanity.com/paper/2504.18353/) (2025)
- [Ratio1 -- AI meta-OS](https://mlsanity.com/paper/2509.12223/) (2025)
- [Uncovering and Understanding FPR Manipulation Attack in Industrial IoT Networks](https://mlsanity.com/paper/2601.14505/) (2026)
- [Agentra: A Supervisable Multi-Agent Framework for Enterprise Intrusion Response](https://mlsanity.com/paper/2606.18325/) (2026)
- [COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies](https://mlsanity.com/paper/2606.30479/) (2026)
- [Actionable Meta-Requirements for AI Robustness Auditing](https://mlsanity.com/paper/2610.14356/) (2026)

## Abstract (arXiv)

Organizations use diverse types of security solutions to prevent cyberattacks. Multiple vendors provide security solutions developed using heterogeneous technologies and paradigms. Hence, it is a challenging rather impossible to easily make security solutions to work an integrated fashion. Security orchestration aims at smoothly integrating multivendor security tools that can effectively and efficiently interoperate to support security staff of a Security Operation Centre (SOC). Given the increasing role and importance of security orchestration, there has been an increasing amount of literature on different aspects of security orchestration solutions. However, there has been no effort to systematically review and analyze the reported solutions. We report a Multivocal Literature Review that has systematically selected and reviewed both academic and grey (blogs, web pages, white papers) literature on different aspects of security orchestration published from January 2007 until July 2017. The review has enabled us to provide a working definition of security orchestration and classify the main functionalities of security orchestration into three main areas: unification, orchestration, and automation. We have also identified the core components of a security orchestration platform and categorized the drivers of security orchestration based on technical and socio-technical aspects. We also provide a taxonomy of security orchestration based on the execution environment, automation strategy, deployment type, mode of task and resource type. This review has helped us to reveal several areas of further research and development in security orchestration.