My cousin Anika works the night shift on a hospital group’s security desk, and over coffee last Sunday she asked the question that keeps coming up on her rota: everyone keeps saying AIOps for Security will change how alerts are handled, but nobody on her floor can say what it actually is. She is not behind — the phrase is barely two years old as a label, and it has no founding paper or standards committee anyone can point to. It is the name the industry drifted into for learning systems and language models doing security work: spotting anomalies, ranking alerts, investigating suspicious email, and — in a few products — acting without a person. Anika’s questions were better than most vendor webinars, so here they are, with the answers she deserved on the spot.
So what is AIOps for Security, in one answer?
It is an editorial label — think of it as a shelf in a bookshop rather than a certified category. On that shelf sit behaviour-based anomaly detection (often sold as UEBA), machine-learned alert scoring, assistants that read and investigate alerts with language models, and the evaluation discipline that decides how much of this can be trusted. Notice what sits on a different shelf: the “AIOps” you may already know is Gartner’s term for IT-operations analytics, all event correlation and noise reduction. Security is a different animal because the data source is adversarial — it actively lies to you — and because a single miss can cost a breach. Those two facts change every rule about how the software must be judged.
Will it replace the night-shift analyst?
Anika asked this one with a particular edge, so let me be direct: the evidence points at a different shape of job, not an empty chair. Google’s triage agent, for example, is graded at the recommend level of autonomy — level one on a ladder that tops out at four — and handles a triage in roughly a minute. That is throughput, not judgment. MITRE’s guidance is blunt on the point that a human must evaluate the machinery’s output; the accountability does not transfer with the licence. What actually happens in teams that adopt these tools is that the reading volume collapses and the adjudication work concentrates. The night shift stops being a conveyer belt and starts being the safety inspector. The analyst category most of this builds on — behaviour analytics, the UEBA shelf — has been part of the security vocabulary since around 2015, which is worth remembering whenever a demo implies the floor beneath it is brand new.
Why does it cry wolf over harmless logins?
Because “strange” is usually just “new”. Most anomalies resolve into something mundane — a software change nobody documented, a colleague’s first week, a job that rescheduled itself. The mathematics makes the crying worse. Axelsson’s classic work on detection put it precisely: when the base rate of genuine attacks is 2 in 100,000, a detector whose false alarms run at 1 per 100,000 gets you a positive predictive value of 66.7% — but relax those false alarms to 1 per 1,000 and the value collapses to roughly 1.4%. One decimal place in the wrong direction, and nineteen of every twenty alerts are noise. No amount of vendor confidence changes that arithmetic; it belongs to the data, not the model.
Can it really close alerts without asking?
Some products already do, and here Anika’s scepticism serves her well. The sensible model grants autonomy per action class, rung by rung: observe everything at level zero; recommend at level one; auto-close at level two only once a demonstrated miss bound of 2% or better exists across 150-plus true positives, with planted canaries in the flow, a sealed holdout, and one-click reopen; reversible actions at level three once a demonstrated false-action bound of 1% or better exists on 300-plus would-have-acted verdicts, with rollback rehearsed and rates capped. Level four — irreversible actions — is never granted to a machine, full stop. Nor is a grant permanent: the drill that keeps an auto-closer honest runs on planted cases, a batch of fifty each quarter, with a standing rule that three closed plants ends the experiment and the privilege together. The cautionary tale is the vendor that skipped the observation rung entirely: Microsoft’s Phishing Triage Agent starts closing real mail from its first hour in service, and the company documents no observe-only mode for it as of October 2026. Anika’s team would be right to ask which rung a product actually occupies, and to treat silence as an answer.
Are those AIOps for Security demo scores real?
The scores are usually real; the question is what they were earned on. Between 2019 and 2022, the TESSERACT research line took published security-ML results showing F1 scores near 0.99 and showed how spatial and temporal bias in the test setup had inflated them. A wider audit led by Arp and co-authors checked thirty papers from the top security machine-learning venues and found sampling bias in nine out of ten, with data snooping — test information leaking into training — in nearly three quarters. If the academic bar is that low, imagine the marketing one. There is a working heuristic worth carrying into every vendor meeting: a figure that approaches perfection on a hard, adversarial problem is evidence about the evaluation, not the engine. The respectable independent benchmarks post humbler — and more believable — numbers, and even they measure generic scenarios, not your mail flow. A demo score is a reason to start a conversation, never a reason to end one.
What should I ask before we trial one?
Anika’s last question was the practical one, so here is the checklist worth taping to the monitor:
- Which rung of the autonomy ladder does the product claim, and for which action class — recommending, closing, or acting?
- Is there a genuine observe-only mode, and can we watch it rank for a month before anything is closed?
- What are the per-category miss rates — not the blended number, which can hide a catastrophic category behind a decent average?
- How many labelled cases, and whose labels, stand behind the accuracy claim?
- What leaves our tenancy: does the assistant upload attachments to external sandboxes, and what data-sharing defaults are switched on?
That last line matters more in healthcare than almost anywhere. Microsoft turns customer-data sharing on by default for Security Copilot unless the tenant licences at the E5 or E7 tier, and Google’s Security Operations runs Gemini requests on global endpoints — the company states prompts stay out of training, but the residency question still belongs in the procurement file. There is also the older trap: VirusTotal’s own terms concede that what gets uploaded can reach its paying customers. A suspicious attachment is evidence; uploading it is a disclosure decision.
The question behind all six
What Anika was really asking is who carries the risk when software joins the response chain. The honest answer: the team that signs the gates. Prompt injection gives the sharpest edge to that point — the UK’s NCSC guidance treats an LLM as a deputy that can be confused by anything it reads and warns the problem may never be fully mitigated, which pushes teams toward deterministic guards and least-privilege scopes instead of hopeful filtering. Teams already thinking about adopting smart technology and AI responsibly will recognise the pattern; the same discipline shows up in a practical guide to building secure software, and the habit of writing down what an assistant may and may not do pairs naturally with keeping AI prompts organised rather than improvised. For the full map — rungs, gates, evaluation drills — this plain-language AIOps for Security guide is the reference to keep beside the coffee machine.
Anika went back on shift with a shorter list than she arrived with: count what is real, watch before trusting, grant by the rung, and keep the evidence in writing. Somewhere between the second coffee and the last question, the label stopped being a mystery and started being a discipline she could hold her vendors to. Not a bad summary of the whole field — or of any hospital’s approach to a new machine on the ward.