My cousin Anika works the night shift on a hospital group’s security desk, and over coffee last Sunday she asked the question that keeps coming up on her rota: everyone keeps saying AIOps for Security will change how alerts are handled, but nobody on her floor can say what it actually is. She is not behind \u2014 the phrase is barely two years old as a label, and it has no founding paper or standards committee anyone can point to. It is the name the industry drifted into for learning systems and language models doing security work: spotting anomalies, ranking alerts, investigating suspicious email, and \u2014 in a few products \u2014 acting without a person. Anika’s questions were better than most vendor webinars, so here they are, with the answers she deserved on the spot.<\/p>\n
It is an editorial label \u2014 think of it as a shelf in a bookshop rather than a certified category. On that shelf sit behaviour-based anomaly detection (often sold as UEBA), machine-learned alert scoring, assistants that read and investigate alerts with language models, and the evaluation discipline that decides how much of this can be trusted. Notice what sits on a different shelf: the “AIOps” you may already know is Gartner’s term for IT-operations analytics, all event correlation and noise reduction. Security is a different animal because the data source is adversarial \u2014 it actively lies to you \u2014 and because a single miss can cost a breach. Those two facts change every rule about how the software must be judged.<\/p>\n
Anika asked this one with a particular edge, so let me be direct: the evidence points at a different shape of job, not an empty chair. Google’s triage agent, for example, is graded at the recommend level of autonomy \u2014 level one on a ladder that tops out at four \u2014 and handles a triage in roughly a minute. That is throughput, not judgment. MITRE’s guidance is blunt on the point that a human must evaluate the machinery’s output; the accountability does not transfer with the licence. What actually happens in teams that adopt these tools is that the reading volume collapses and the adjudication work concentrates. The night shift stops being a conveyer belt and starts being the safety inspector. The analyst category most of this builds on \u2014 behaviour analytics, the UEBA shelf \u2014 has been part of the security vocabulary since around 2015, which is worth remembering whenever a demo implies the floor beneath it is brand new.<\/p>\n
Because “strange” is usually just “new”. Most anomalies resolve into something mundane \u2014 a software change nobody documented, a colleague’s first week, a job that rescheduled itself. The mathematics makes the crying worse. Axelsson’s classic work on detection put it precisely: when the base rate of genuine attacks is 2 in 100,000, a detector whose false alarms run at 1 per 100,000 gets you a positive predictive value of 66.7% \u2014 but relax those false alarms to 1 per 1,000 and the value collapses to roughly 1.4%. One decimal place in the wrong direction, and nineteen of every twenty alerts are noise. No amount of vendor confidence changes that arithmetic; it belongs to the data, not the model.<\/p>\n
Some products already do, and here Anika’s scepticism serves her well. The sensible model grants autonomy per action class, rung by rung: observe everything at level zero; recommend at level one; auto-close at level two only once a demonstrated miss bound of 2% or better exists across 150-plus true positives, with planted canaries in the flow, a sealed holdout, and one-click reopen; reversible actions at level three once a demonstrated false-action bound of 1% or better exists on 300-plus would-have-acted verdicts, with rollback rehearsed and rates capped. Level four \u2014 irreversible actions \u2014 is never granted to a machine, full stop. Nor is a grant permanent: the drill that keeps an auto-closer honest runs on planted cases, a batch of fifty each quarter, with a standing rule that three closed plants ends the experiment and the privilege together. The cautionary tale is the vendor that skipped the observation rung entirely: Microsoft’s Phishing Triage Agent starts closing real mail from its first hour in service, and the company documents no observe-only mode for it as of October 2026. Anika’s team would be right to ask which rung a product actually occupies, and to treat silence as an answer.<\/p>\n
The scores are usually real; the question is what they were earned on. Between 2019 and 2022, the TESSERACT research line took published security-ML results showing F1 scores near 0.99 and showed how spatial and temporal bias in the test setup had inflated them. A wider audit led by Arp and co-authors checked thirty papers from the top security machine-learning venues and found sampling bias in nine out of ten, with data snooping \u2014 test information leaking into training \u2014 in nearly three quarters. If the academic bar is that low, imagine the marketing one. There is a working heuristic worth carrying into every vendor meeting: a figure that approaches perfection on a hard, adversarial problem is evidence about the evaluation, not the engine. The respectable independent benchmarks post humbler \u2014 and more believable \u2014 numbers, and even they measure generic scenarios, not your mail flow. A demo score is a reason to start a conversation, never a reason to end one.<\/p>\n
Anika’s last question was the practical one, so here is the checklist worth taping to the monitor:<\/p>\n
That last line matters more in healthcare than almost anywhere. Microsoft turns customer-data sharing on by default for Security Copilot unless the tenant licences at the E5 or E7 tier, and Google’s Security Operations runs Gemini requests on global endpoints \u2014 the company states prompts stay out of training, but the residency question still belongs in the procurement file. There is also the older trap: VirusTotal’s own terms concede that what gets uploaded can reach its paying customers. A suspicious attachment is evidence; uploading it is a disclosure decision.<\/p>\n
What Anika was really asking is who carries the risk when software joins the response chain. The honest answer: the team that signs the gates. Prompt injection gives the sharpest edge to that point \u2014 the UK’s NCSC guidance treats an LLM as a deputy that can be confused by anything it reads and warns the problem may never be fully mitigated, which pushes teams toward deterministic guards and least-privilege scopes instead of hopeful filtering. Teams already thinking about adopting smart technology and AI responsibly<\/a> will recognise the pattern; the same discipline shows up in a practical guide to building secure software<\/a>, and the habit of writing down what an assistant may and may not do pairs naturally with keeping AI prompts organised rather than improvised<\/a>. For the full map \u2014 rungs, gates, evaluation drills \u2014 this plain-language AIOps for Security guide<\/a> is the reference to keep beside the coffee machine.<\/p>\n Anika went back on shift with a shorter list than she arrived with: count what is real, watch before trusting, grant by the rung, and keep the evidence in writing. Somewhere between the second coffee and the last question, the label stopped being a mystery and started being a discipline she could hold her vendors to. Not a bad summary of the whole field \u2014 or of any hospital’s approach to a new machine on the ward.<\/p>\n","protected":false},"excerpt":{"rendered":" A night-shift analyst asks six honest questions about AIOps for Security \u2014 what the label covers, whether analysts disappear, and what to ask before a trial.<\/p>\n","protected":false},"author":12,"featured_media":3027,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1171],"tags":[],"class_list":["post-3026","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-healthcare-it"],"yoast_head":"\n