Wait, have you actually tested what happens when your phone dies or your only on-call person is in a dead zone at that exact moment? Because I bet that's the real gap hiding under the automation one. We set up auto quarantine last year, thought we were golden, then found out our ticketing system and the firewall vendor had a handshake issue that silently dumped all the actions into a error log nobody checked. The alert fired, the automation fired, but the actual block never happened and we only caught it during a audit months later. So sure, build those auto responses, but build a status check that yells at you if the automated action fails too. Otherwise you end up with a whole new layer of stuff to ignore at 2 AM, just quieter.