Quick answer
Process/systems/data/permissions/exceptions/owners/metrics, one by one. Automation security = least privilege/key management/logs/redaction/human review.
Why it matters
Asking only 'what to automate' misses data/permission issues.
Don't put keys in workflow notes.
Step by step
- Map the current workflow: trigger/inputs/steps/owner/exceptions/output.
- Measure frequency/hours/error cost and pick one workflow worth automating.
- Build a minimal loop with human review/rollback.
- Add monitoring/logs/permissions; run two weeks before expanding.
- Calculate real ROI including implementation/maintenance.
Common mistakes
- Automating a bad process.
- Ignoring exceptions/human review.
- No monitoring/owner.
- Counting time saved but not implementation/maintenance.
Checklist
- Workflow/trigger/exceptions/owner mapped.
- ROI includes implementation/maintenance/error costs.
- Minimal loop + human review + rollback.
- Permissions/keys/logs/redaction.
- Monitoring/owner/review cadence.
Key facts
- Don't put keys in workflow notes.
- Admin accounts are the biggest risk.
FAQ
What does a Automation security audit cover?
Process/systems/data/permissions/exceptions/owners/metrics, one by one. Automation security = least privilege/key management/logs/redaction/human review.
How long does it take?
Usually 1-3 minutes; for intermittent issues, run 30 seconds and retest elsewhere.
Is data uploaded?
Runs locally and does not upload video/audio; extensions may still read the page.
Source: OWASP