AI in security operations: what it changes, and what it does not

The first is the cost of reading. A security operations queue has always held more signal than a team can process, and the traditional answer was to raise thresholds until the volume fit the staffing. That is a rationing decision dressed as a tuning decision, and everything below the threshold was never examined by anyone. A system that can read every alert with its surrounding context removes the need to ration, which is a genuine change rather than a marketing one.

The second is the cost of pursuit. Confirming whether a finding actually leads anywhere has always been the expensive part of both detection and offensive testing, which is why so much tooling output stops at a severity score. Automating pursuit changes what a finding is: not a possibility, but a path that either terminates or does not.

Both are cost changes rather than capability changes, and that is the honest framing. Nothing here is a technique a competent human could not perform. What changes is how many times per day it is economically possible to perform it.

Over the reporting period, ENISA collected and curated 4 875 events. Once this significant share is redacted, the top five targeted sectors in the EU include public administration (38.2%), transport (7.5%), digital infrastructure and services (4.8%), finance (4.5%) and manufacturing (2.9%).

Accountability did not move. If an automated response isolates a host in the middle of a payment run, the conversation afterwards is with your organisation, not with a model provider. Every serious buyer knows this, which is why a claim of full autonomy tends to lengthen a sales cycle rather than shorten it.

Verification did not become free either. A finding that has not been reproduced is a hypothesis, and shipping hypotheses to a customer moves the triage cost rather than removing it.

The field has largely conceded this in its own standards. The OWASP Top 10 for LLM Applications 2025 lists excessive agency as LLM06, a distinct risk category rather than a footnote about tuning. When the industry risk register names your product's headline feature as a hazard, the defensible position is to describe your brakes rather than your speed.

An LLM-based system is often granted a degree of agency by its developer, the ability to call functions or interface with other systems via extensions.

Buyers evaluating this category do not have to invent criteria. The NIST AI Risk Management Framework, NIST.AI.100-1, released on 26 January 2023, organises the problem into four functions: govern, map, measure and manage. It is voluntary and it is not a certification, which is precisely why it works as shared vocabulary between a buyer and a vendor who have never met.

NIST added a generative AI profile, NIST-AI-600-1, on 26 July 2024. That is the relevant companion when the system in question is model-driven rather than statistical, which is the case for everything currently marketed as an AI SOC.

European buyers carry a second layer. The AI Act, Regulation (EU) 2024/1689, entered into force on 12 July 2024 and sets obligations that vary with the risk class of the system. Whether a given security tool falls into a regulated class is a legal assessment for your organisation rather than something a vendor page can settle, and a vendor who asserts the answer is answering a question they cannot see.

Utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken.

The argument that reading volume is the binding constraint is easy to assert and worth checking against numbers. The ENISA Threat Landscape 2025 is the closest thing to a public census of European incidents, and its distribution is instructive.

Phishing accounts for around 60 percent of observed cases and vulnerability exploitation for 21.3 percent. Both are high-frequency, low-distinctiveness events: individually unremarkable, and dangerous mainly in aggregate or in combination. That is precisely the shape that gets lost when thresholds are raised to fit staffing.

The DDoS figure sharpens it further. Availability attacks affected 81.4 percent of EU sectors in the period and were largely hacktivist and low impact, which means most of them are noise that still has to be read before it can be dismissed. A queue dominated by events that are individually unimportant and collectively unignorable is the exact workload a model relieves and a human cannot.

The phrase describes how something was built rather than what it does for you, which is why two products both described as AI-native can have nothing meaningful in common. It is the sort of term that helps a vendor position and hinders a buyer compare.

A more useful decomposition asks three separate questions. What does the system read? What does it decide? What does it do without being asked? Products that sound identical in a category name diverge sharply on the third.

That decomposition also survives the next model generation, which a feature comparison does not. The underlying models will change repeatedly during a normal contract term. What the system is permitted to do without approval is a property of your deployment, and it changes only when someone decides to change it.

For an organisation inside NIS2 or DORA scope, a security tool is part of the estate being regulated. That turns two questions structural rather than preferential: where the processing happens, and whether the arrangement survives a supervisory conversation.

Model-driven tooling sharpens the question, because inference may run somewhere the rest of the stack does not. A detection pipeline hosted in Europe that sends alert context to an endpoint elsewhere has moved the data without moving the diagram, and the diagram is what most architecture reviews look at.

This is the one place where naming the model and the hosting is worth more than any accuracy claim. It is a fact about the contract rather than a fact about the technology, and a vendor who has thought about it can answer in a sentence.