xe2x80x9cits a generally exhausting fieldxe2x80x9d A LargeScale Study of Security Incident Management Workflows and Pain Points Security incident management is of increasing importance given the growth in cybersecurity threats and regulatory attention. We provide what is, to the best of our knowledge, the first largescale study of security incident management, consisting of a survey with more than 500 security incident management practitioners grounded by interviews with practitioners in 10 organizations, including companies and educational institutions. We find that some aspects of incident management workftows are consistent across organizations and incident management teams (e.g., collaboration and prioritization), but that the complexity of incident management generally grows with organization size, in that practitioners encounter a wider variety and volume of incidents, collaboration partners and tools. These variations suggest several ways in which tools can better support efficient incident management.

Mining Text in Incident Repositories: Experiences and Perspectives on Adopting Machine Learning Solutions in Practice Machine learning based datadriven solutions have potential to significantly improve quality of incident management process and make it cost effective. We present our experiences while addressing a spectrum of interrelated problems encountered in practice including identifying semantically related incidents, assignee recommendation, and mapping of incidents to business processes. We argue that despite longstanding research, it is not always straightforward to adopt recommendations from research into practice due to variability and complexity of business constraints and nature of data. We discuss need for metalevel analysis and suggest our own recommendations towards designing pragmatic solutions with low barriers to adoption and addressing right level of challenges.