Patent attributes
Disclosed herein are methods, systems, and processes for facilitating security orchestration, automation, and response (SOAR) in cybersecurity computing environments that use biometric data or implement biometric data gathering. An instruction is periodically transmitted to a protected computing device to perform a security scanning operation that captures biometric data generated from a biometric device associated with the protected computing device. The biometric data received from the protected computing device includes a biometric identity of a trusted user or an untrusted user. A security database is accessed to determine whether the biometric identity matches a stored biometric identity of the trusted user. A security workflow that includes orchestrated security operations configured to identify the untrusted user and to prevent the untrusted user from accessing the protected computing device if the biometric identity does not match the stored biometric identity is generated and transmitted to the protected computing device. A confirmation is received from the protected computing device that the orchestrated security operations have been performed.