Somewhere this morning, a security operations centre closed a few thousand suspicious emails without a human opening a single one of them. No analyst glanced at the senders. No team lead signed the file. A model decided, inside somebody’s tenancy, that the evidence was not worth keeping. The marketing around tools like this has settled on a young label \u2014 AIOps for Security \u2014 and for readers who live near courts and compliance, the questions it raises should feel familiar. Who decided? On what evidence? Against what standard of proof? And who answers when the decision turns out wrong?<\/p>\n
Start with what the words actually denote. This is an emerging editorial label, not a certified standard: there is no founding milestone, no standards body, and no version number anyone can cite. The market uses neighbouring phrases \u2014 AI SOC agents, AI-assisted security operations, UEBA, security analytics \u2014 and they overlap heavily. Gartner’s 2026 hype cycle files the agent category right at the top of its curve, in inflated-expectations territory. What is worth keeping separate is the older “AIOps” of IT operations, which is about correlating infrastructure events. Security work differs in kind: the data feeding it is adversarial and adaptive, and a missed intrusion costs breach-level money rather than one slow night of paging.<\/p>\n
Any dispute about automated triage eventually lands on base rates, because they dominate the outcome. Take a modern SIEM picture: fifty million events flow in per day, of which perhaps fifty are genuinely malicious. If the detector’s false-alarm rate sits at one in ten thousand, roughly five thousand innocent events get flagged for every true attack \u2014 the share of alerts that are real lands near 0.9%, and an analyst reads about 112 alerts to find one genuine threat. Tighten the error rate to one in a million and the picture flips: about 47.4% of alerts are then real. Same events, same attackers, wildly different workload. This is why a tool demo on curated input proves almost nothing; the population being screened decides whether the tool helps or drowns the team.<\/p>\n
Useful conversations grade the judgement instead of treating it as binary. Picture an autonomy ladder awarded one rung at a time, for one class of action \u2014 never for the product in bulk:<\/p>\n
Closing an email is not the same act as editing a firewall rule. Each class earns its own evidence, and a vendor’s badge on phishing says nothing about its entitlement to act on identity events. Procurement teams that insist on the ladder before the purchase routinely discover the vendor’s slide deck only ever mentioned one rung \u2014 the flattering one.<\/p>\n
The market has not waited for anyone’s comfort. Microsoft’s Phishing Triage Agent, as documented in October 2026, starts auto-closing the moment it runs \u2014 no observe-only mode is documented at all, so tenants who wanted a silent evaluation phase did not get one. Google’s Triage & Investigation Agent sits a rung lower, spending roughly a minute per triage, with a person still closing each ticket. And Sentinel’s Fusion engine is giving way to Defender XDR correlation, with every workspace required to migrate by 31 March 2027. Whichever camp you sit in, machinery closing alerts is now the default trajectory, not a pilot.<\/p>\n
Consider a worked triage evaluation of the kind practitioners have started to publish. A blind-labelled set of 1,240 emails contained 71 true positives; the agent missed 2 of them, a miss rate of 2.8%. That sounds admissible \u2014 until the uncertainty is computed. With so few true positives, the 95% upper bound sits near 8.6%, which fails a 2% gate without difficulty. The same study reported 99.8% precision on the items it closed, a verdict-level precision of 86% on the alerts it called genuine, and put 93.5% of analyst workload in the removable pile. Every number is honest; only some of them support automation. A statistician would call the point estimate misleading. A lawyer would call it a productive opening question.<\/p>\n
Two claims deserve permanent scepticism. First, that the AI will run the SOC on its own: MITRE’s guidance keeps a human on the hook to evaluate whatever the machinery produces, and the ladder caps out before irreversible action for exactly that reason. Second, that anomalous means malicious: in working estates, most anomalies turn out to be organisational changes, new hires and freshly deployed tools, not intrusions. The UK’s NCSC adds a third caution for anything that reads attacker-controlled text \u2014 prompt injection is not an input-filtering bug that better validation will close, because the model is an inherently confusable deputy; what holds is deterministic guards and least privilege, not cleverer wording. None of this argues against the tooling. It argues for treating every automated closure the way a good court treats an expert witness: admissible, but only within tested limits, with the burden of proof resting on the side asking to be trusted.<\/p>\n
A deployment that can survive scrutiny does three unglamorous things continuously:<\/p>\n
The trend line for the rest of 2026 is easy to read: more agents, more unattended closure, more dashboards quoting accuracy figures nobody has reproduced. Procurement conversations will increasingly turn on whether the buyer knows which questions to ask, and the answers are older than the technology. The discipline separating a defensible rollout from an indefensible one is laid out in the Ops Atlas’s working definition of AIOps for Security<\/a>, and most of it is bookkeeping \u2014 precisely the habits above. Readers who follow our coverage will recognise the shape immediately, because it is the same file a litigant builds to survive cross-examination. The three most recent roundups of Indian legal developments<\/a> \u2014 including the June 18<\/a> and June 17<\/a> editions \u2014 show regulatory attention to automated decision-making building steadily, and a security team that cannot show its numbers will end up answering the questions a court would have asked anyway.<\/p>\n
Software now closes security alerts unaided. What should be demanded first: base-rate arithmetic, graded autonomy and vendor claims that survive scrutiny.<\/p>\n","protected":false},"author":6,"featured_media":12605,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10013],"tags":[],"class_list":["post-12604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-legal-tech"],"_links":{"self":[{"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/posts\/12604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/comments?post=12604"}],"version-history":[{"count":1,"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/posts\/12604\/revisions"}],"predecessor-version":[{"id":12620,"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/posts\/12604\/revisions\/12620"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/media\/12605"}],"wp:attachment":[{"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/media?parent=12604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/categories?post=12604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wakilsahab.in\/news\/wp-json\/wp\/v2\/tags?post=12604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}