Integrating artificial intelligence (AI) with human judgment in Security Operations Centers (SOCs) is essential for optimizing efficiency and effectiveness. A recent discussion with a Chief Information Security Officer (CISO) from a major corporation highlighted this need. While AI was successfully implemented for certain detection tools, a broader approach was necessary to address all alerts effectively.
Understanding Human Cognition in Security Operations
The concept of dual thinking systems, as explained by psychologist Daniel Kahneman, offers valuable insights for security operations. Kahneman identifies two cognitive systems: System 1, which is fast and automatic, handling about 95% of human cognition, and System 2, which is slow and deliberate, managing the remaining 5%. This division mirrors the ideal setup for a SOC, where most alerts are processed automatically, reserving human judgment for the few critical cases.
Research supports this approach, indicating that 98% of enterprise alerts can be autonomously resolved, similar to Kahneman’s cognitive model. Thus, a well-designed SOC should emulate this balance, using AI for rapid alert processing and human expertise for complex problem-solving.
The Role of AI in Alert Management
In the realm of SOCs, the majority of alert triage should be handled by AI, much like System 1 in human cognition. AI systems can swiftly determine whether a file is malicious or if a login is suspicious, operating continuously and efficiently, even with minimal human oversight. This allows analysts to focus on genuine threats rather than routine alerts.
However, forcing human analysts into roles suited for automatic processing can lead to fatigue and missed threats. Properly utilizing AI ensures that alerts are processed quickly, reducing the cognitive load on human teams and improving threat detection accuracy.
The Importance of Human Judgment in Security
While AI handles the bulk of alerts, human analysts play a vital role in the SOC for the remaining 2% of cases that require deep analysis and judgment. Tools like Claude, Codex, and Cursor enhance this capability by providing detailed contextual information, allowing analysts to make informed decisions.
This co-pilot approach ensures that AI systems handle the initial investigation, presenting analysts with fully assembled cases. Thus, human expertise is applied where it is most needed, enhancing the overall effectiveness of security operations.
By integrating AI and human judgment effectively, SOCs can improve their efficiency and accuracy. This dual-system approach not only aligns with Kahneman’s cognitive model but also ensures that security teams can manage threats proactively and effectively.
