The case for keeping humans at the helm

There’s a growing chorus in our industry selling a tempting vision: a fully autonomous, AI-powered SOC that runs itself. Alerts triaged, false positives dismissed, investigations opened and closed — all without a human in the loop. For resource-constrained security teams drowning in alerts, the pitch lands hard.

But as security leaders, when we hear “fully autonomous SOC,” our BS meters go off.

Our industry has started treating “AI” and “automation” as synonyms, and that conflation is one of the most dangerous mistakes we’re making right now. Automation will absolutely play a critical role in modernizing security operations — for enrichment, correlation and triaging the well-understood, high-volume work that machines genuinely do better than people. But automation is not a replacement for judgment, and AI is not a license to take humans out of the loop.

It’s also not a quick-fix cost saver. Conventional wisdom still believes that replacing humans with AI will drastically reduce costs, but tech leaders are sounding the alarm to the contrary. Nvidia’s vice president of applied deep learning sent shockwaves through the tech sector in April when he told Axios that “the cost of compute is far beyond the costs of the employees” for his team. And The Information reported that Uber’s CTO blew through his full 2026 AI budget by the end of April. 

What actually happens when you remove the human

Pull humans out of the decision-making, and four things start to compound.

First, you reinforce a bad process. Every alert closed without human review is a data point telling the system “This was fine.” If the model was wrong, you’ve now baked that error into the loop. Wrong once becomes wrong at scale, and the problem grows tenfold before anyone notices.

Second, you miss false negatives. False positives get most of the attention because they’re noisy and annoying. But the real danger is the alert that should have fired and didn’t — or the one that fired, got auto-closed and turned out to be the early signal of a breach. Good attackers know how to hide in the noise, and they count on automated agents missing the signal underneath it leading to more slow-moving attacks and advanced persistent threats. 

Third, you strip out strategy and judgment. A great SOC brings knowledge of the business, awareness of recent changes, threat intel and gut instinct earned over years of incidents.

Analysts pattern-match across context that a machine simply doesn’t have. That’s not a process you automate away. Take humans out of the loop, and you’re not running a faster SOC — you’re running a blinder one.

Fourth, you kill an important training ground for tier one analysts. For new analysts, the SOC is a critical environment to develop and hone their skills as they work toward becoming tier one analysts. More than taking away professional opportunities, this weakens the security of organizations. Without experienced analysts, organizations are fully dependent on third parties to protect their interests, account for all edge cases, understand nuances of the tech stack and make the right decisions. 

What the board, the auditors and the regulators actually want

When we sit across from my board, my auditors or a regulator after an incident, three things matter:

1. Visibility into what the system is doing and why, not a black box that says, “trust me.”
2. Control over which decisions get automated and which require human signoff, with analysts empowered to make the calls that matter.
3. Evidence — a clear, auditable trail of every step and every decision, so I can demonstrate we followed industry standards and acted reasonably.

This matters more every year. CISOs are increasingly being targeted personally in litigation and enforcement actions. If you can’t show that a human exercised judgment on a consequential decision, you can’t credibly claim reasonableness. Just as ignorance of the law is not a sufficient legal excuse, “the AI said so” is not a defense that holds up in a deposition, regulatory inquiry or board postmortem.

Automation belongs in the SOC — for enrichment, correlation, evidence gathering and running well-understood playbooks. But the consequential decisions — the validation, the prioritization, the call on whether something is truly benign — stay with the analyst.

AI shouldn’t close the loop on its own. It needs to give analysts the depth of insight to make sharper, faster, more defensible decisions and it surfaces every step of its reasoning so they can interrogate it.

That transparency is what separates a real SOC from a black box.

A SOC built on autonomy is a SOC quietly accumulating risk it can’t see. A SOC built on humans at the helm, with AI as the force multiplier, is one that holds up under pressure, under audit and under attack.

That’s the model the next generation of threats will demand, and it’s the only one we’d trust to run.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?