I saw an article about automating responses to security issues being a marathon not a sprint. The articles gives a few examples of different levels of automation response to situations, noting that each of this is a different level of maturity in the organization. At early stages, the response is mostly alerting a human to take action. Later, the automation will make some changes, but still defer to a human for more actions. The final example is automation handling most of the issue itself.

The idea is that improving security with automation is something that takes place across time, as the organization matures and becomes more comfortable and trusting of automation. It's a marathon, where we push, but we know this will take some time to get to the end. It's not a sprint where we make a quick fix and get a result.

Actually a lot of things are marathons in the technology area. That's if we are looking to improve how we work with automation. If we like just firefighting issues and building quick patches, then we're constantly sprinting.

A lot of the work I do in advising clients about DevOps is to get them to think marathon. There isn't really a finish line, but we are racing our competitors and trying to improve how we work. We just need to recognize that this is a process that takes months, not minutes. We want to mature and evolve processes, making them better over time. We also start small with our scope, hoping that we expand things to the entire organization over time, but again, that time is months.

This was my same approach as both a developer and DBA. Find something that I can automate to make better, start to improve it, learn from success and failure, and repeat. At some point, I usually found something was working well enough to move on to a new area to improve. If I needed to come back and continue to improve something, I could do that as well.

I don't like sprinting. In real life, or in technology. I prefer to think marathon. We are pushing to achieve something, but with the further away future in mind, not the next few minutes.