For most of the past decade, the security operations centre has been defined by a familiar rhythm: ingest alerts, triage events, escalate incidents, repeat. That operational model is breaking down — not gradually, but at a pace that is leaving unprepared organizations measurably exposed. The conversation happening among security practitioners right now isn’t about whether AI belongs in the security stack. That debate is settled. The conversation that matters is whether enterprise security architectures are mature enough to absorb AI effectively, and whether security teams are building the human oversight structures that autonomous defense demands.
Both questions surfaced with notable clarity at the recent DTX conference in Manchester, where a panel of working security practitioners offered a grounded and occasionally uncomfortable assessment of where enterprise security operations actually stand.
Autonomous Attacker Tooling Has Already Changed the Equation
The threat environment that security teams are operating against has shifted structurally. Adversaries are deploying AI-accelerated reconnaissance, generating phishing content at industrial scale, and using machine learning to iterate malware faster than signature-based defenses can respond. This is not a projected future state — it is the operational reality that SOC analysts are navigating in production environments today.
What this produces is a machine-versus-machine dynamic that legacy security operations architectures were never designed to handle. Human analysts working ticketing queues and reviewing alert dashboards are not competing effectively against automated attack pipelines that execute in milliseconds and adapt in near-real time. The competitive disadvantage compounds with every year that organizations delay structural investment in autonomous defense capability.
Kelly Bissell, former corporate VP of product abuse and risk at Microsoft, framed it with characteristic directness: an arms race is underway, and early adopters carry the advantage. That advantage is not permanent or self-sustaining — it requires continuous investment and operational sophistication — but the window for organizations to close the gap is narrowing as attacker tooling matures.
What Microsoft’s Neural Network Work Actually Demonstrates
Bissell’s account of Microsoft’s behavioral defense work is instructive beyond the specific technical detail. Using neural networks to identify typosquatted domains being registered in advance of impersonation campaigns — with low false positive rates at Microsoft’s data scale — illustrates a fundamental principle: behavioral pattern detection at machine speed produces outcomes that human review cannot replicate. The organizational precondition was access to behavioral data at sufficient scale to train models with operational precision.
That precondition matters enormously for enterprise security leaders. The effectiveness of AI-driven defense is directly proportional to the quality, breadth, and historical depth of the telemetry feeding it. Organizations that have underinvested in logging, normalization, and security data infrastructure will find their AI security investments underperforming relative to expectations — not because the technology is flawed, but because the foundational data architecture isn’t ready.
AI Amplifies Mature Security Architectures — It Cannot Substitute for Immature Ones
This was perhaps the most practically important consensus to emerge from the DTX panel, and it deserves wider circulation among security leaders who are under significant internal pressure to deploy AI capabilities quickly. Multiple practitioners were explicit: AI cannot be successfully applied until the fundamentals of cyber defense are well covered. System hardening, patch discipline, access control, and monitoring hygiene are not prerequisites that AI makes optional — they are the preconditions that determine whether AI operates as a force multiplier or as an expensive overlay on a fragile foundation.
Darren Kimuli, information security lead at Canopius Group, articulated the framing that should govern every AI security investment discussion: the question isn’t what AI replaces, it’s what AI fits. That distinction carries significant budget and governance implications. Organizations rushing to procure AI-native security platforms while carrying significant technical debt in identity management, endpoint visibility, or log coverage are likely to generate sophisticated-looking dashboards on top of underlying blind spots.
The CISO who can honestly answer “where does AI fit our current security maturity?” is in a substantially stronger position than one chasing capability announcements. That assessment, done rigorously, also produces a sequenced investment roadmap that is far more defensible in board-level budget conversations.
Alert Fatigue Was a Symptom — Autonomous Triage Is the Treatment, Not a Cure
The security industry has discussed alert fatigue as a problem for years. What AI is changing is the operational response available to address it. Divine Uzodinma of Radius described the practical shift underway in SOC workflows: AI systems handling log correlation and alert triage while analysts redirect their attention to investigation and response. Muhammad Khan of Bridgewater Finance Group reinforced the point — AI-based tooling is demonstrably reducing the alert volume burden that has driven analyst burnout and talent attrition across the industry.
This operational benefit is real and meaningful. But the panel’s framing around it was notably nuanced. As AI systems absorb triage functions, analyst roles are evolving from monitoring and response toward validating AI outputs and assessing the risk of model error — including hallucination. The SOC analyst of 2026 increasingly needs to understand not just whether a threat is real, but whether the AI’s characterization of that threat is reliable. That is a fundamentally different cognitive task that requires different training, different tooling, and different performance metrics.
The organizations getting this right are redesigning job roles and capability frameworks alongside the technology deployment. The ones getting it wrong are deploying AI triage tools and assuming existing analyst competencies transfer cleanly.
The Governance and Skills Gap Is Larger Than Most Security Leaders Acknowledge
George Rees of Secarma made an observation that deserves serious attention from hiring managers and security workforce planners: AI is creating demand for GRC professionals precisely because governance, risk, and compliance expertise translates well into the oversight functions that autonomous security systems require. Prompt engineering, model risk assessment, and AI output validation are emerging as core SOC competencies — not theoretical future skills, but practical requirements for teams operating AI-augmented workflows today.
Bissell’s taxonomy of CISO operating profiles — compliance-oriented, package-focused, and elite practitioners — maps directly onto the readiness gap. Elite practitioners, in his framing, will actively pursue AI capability to sharpen their operations. The compliance-oriented and package-focused cohorts risk being outpaced, not by attackers alone, but by peer organizations that are building institutional AI fluency faster.
The workforce implication for security leaders is concrete: the talent profile for SOC hiring is shifting, and organizations that haven’t updated job descriptions, interview criteria, and development pathways to reflect AI operational requirements are already falling behind in their talent pipeline.
The Oversight Imperative Cannot Be Engineered Away
Running through the entire DTX discussion was a theme that vendors and technology advocates sometimes underemphasize: human oversight of autonomous security systems is not optional, and it is not a temporary condition until AI matures further. The panel was consistent on this point. Clarity on cyber team roles when automation is making security decisions isn’t a nice-to-have governance formality — it is the accountability structure that determines whether autonomous defense systems remain under meaningful organizational control.
Bissell’s recommendation that AI security tools should go through a process equivalent to a software development lifecycle — including penetration testing and guardrails — before reaching production environments reflects an operational discipline that the market is still building toward. Many organizations have deployed AI security capabilities under conditions of urgency that bypassed the testing rigor they would apply to any other production system. The consequence of that shortcut shows up eventually, either as a missed threat that an untested model failed to surface, or as an automated response that generated its own operational disruption.
The machine-versus-machine era doesn’t diminish human judgment — it makes it more consequential. The organizations that understand that distinction are building security operations that can actually scale.
Research and Intelligence Sources: CSO
To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com
