Human-in-the-loop has become one of cybersecurity's favorite answers to the risks posed by AI.
Let the machines investigate. Let them gather evidence. Let them analyze alerts and recommend what happens next. But before the AI does anything consequential, put a human in front of the button.
That makes sense when defenders have time. Alfred Huger isn't convinced they will for much longer.
As attackers increasingly use AI models to accelerate operations, the chief product officer at Command Zero believes security teams will eventually face an uncomfortable tradeoff: Give defensive AI agents greater authority to act autonomously, or preserve human approval and risk responding too slowly.
"When you see attackers leveraging open weight models and frontier models, I think the luxury of you allowing for human in the loop is time limited," Huger said during a recent episode of CYBR.HAK.CAST.
Full episode and related article:
, and CYBR.SEC.Media
ARTICLE HERE
If he's right, one of the biggest questions surrounding AI in the SOC is about to change. It won't be whether security teams trust AI enough to make decisions. It will be whether they can afford to wait for a human to make them.
Attackers won't wait for the analyst
Huger joined CYBR.HAK.CAST hosts Michael Farnum and Sam Van Ryder for a broader discussion about what separates a mature AI-driven SOC from the growing number of platforms rushing into the category.
Much of that conversation centered on capabilities CISOs should evaluate today: baselining existing SOC performance, understanding pricing, feeding business context into AI systems and establishing appropriate access controls.
But the discussion eventually reached the problem hanging over all autonomous cybersecurity technology. What should the AI actually be allowed to do?
Early deployments have approached the question conservatively.
"When we first started doing AI SOC, most people wanted human in the loop, meaning I want to see the case before I remediate," Huger said.
That's understandable. Containment is fundamentally different from investigation.
An AI system can analyze an alert incorrectly without necessarily damaging the business. Give that same system authority to disable an identity, isolate a machine or otherwise interfere with production, and a bad decision suddenly has operational consequences.
The problem is that attackers aren't operating under the same restrictions.
There is no attacker-in-the-loop requirement forcing a criminal to review what an AI model wants to do before allowing it to continue.
That asymmetry becomes increasingly important as offensive operations accelerate.
"The attacker is forcing the narrative in this case," Huger said. "I don't know how long it is before most attacks are driven by large language models, but I think that is an outcome that we're looking at."
The bigger risk may not be a rogue AI agent
Discussion around autonomous AI security tends to drift toward the most dramatic scenario: an agent escapes its controls, goes rogue and starts accessing things it shouldn't.
Huger sees a more immediate problem.
The agent doesn't have to break free.
It can have exactly the permissions it was supposed to have and still make the wrong decision.
"I think more of a concern is an entitled agent that has good RBAC making bad decisions and containing things they shouldn't," Huger said.
That's a much less cinematic risk, but potentially a much more practical one.
Consider what an autonomous SOC agent could eventually be authorized to do.
It might disable an account after detecting suspected credential compromise. It could isolate an endpoint after identifying malicious activity. It could block communications, alter access or trigger other containment actions intended to stop an attack from spreading.
Those capabilities are useful precisely because they affect the environment.
They're dangerous for exactly the same reason.
A false positive handled by a human analyst creates wasted effort. A false positive handled by an autonomous system with remediation authority could create an outage.
The challenge for CISOs is therefore not simply preventing AI agents from escaping their permissions.
It's designing those permissions so an agent can move quickly enough to stop an attack without having enough authority to turn one bad decision into a business-wide event.
More on the AI SOC:
Bill Brenner
George V. Hulme
AI SOC guardrails can't just be a human approval button
This changes what "AI guardrails" need to mean inside the SOC.
If every consequential action ultimately requires human approval, the human is effectively the final guardrail.
That model works as long as the security team has enough time to investigate the recommendation, understand its consequences and make the decision. Machine-speed attacks challenge that assumption. Huger believes organizations will eventually have to accept some additional business risk and allow AI systems to act on their own.
"You have to also say this platform has the relevant controls in it that I at least believe should work most of the time," he said.
That shifts responsibility toward the architecture surrounding the agent. Role-based access control becomes critical. So does limiting which systems an agent can access, which actions it can perform and how far the consequences of any single decision can spread.
Huger argues that AI SOC agents shouldn't simply receive direct access to the systems organizations care about most.
An agent could potentially need visibility across Microsoft 365, email, identity infrastructure and administrative systems to investigate incidents effectively. But visibility and unrestricted control aren't the same thing.
The architecture should create intermediary layers between the AI and those crown jewels.
"If Anthropic and OpenAI can't [guarantee agents won't slip their controls], I guarantee you a security vendor can't," Huger said.
That means autonomy shouldn't translate into unlimited authority.
It means constraining the agent so that when it inevitably gets something wrong, the architecture limits what "wrong" can do.
Business context becomes part of the safety system
Technical permissions alone won't solve the problem. An autonomous SOC agent also needs to understand the business it's protecting.
Earlier in the CYBR.HAK.CAST conversation, Huger described the contextual knowledge experienced security analysts accumulate over time.
They know who owns an asset, who normally accesses it and whether it has generated false positives before. They understand which systems support critical business processes, which identities have significant blast radius and which unusual activities may actually be normal.
That context becomes even more important when the AI moves from recommending actions to taking them.
Imagine an identity suddenly authenticating from Singapore. That might look suspicious. But what if the employee routinely travels internationally? That context matters. It also can't become an automatic exemption. Other evidence could indicate the account really has been compromised. The AI has to weigh both.
A mature system needs to understand what context matters, how much weight to give it and when contradictory evidence should override it.
That's difficult enough when AI is assisting an analyst. It becomes critical when AI is making the containment decision itself.
The SOC may have to trade certainty for speed
None of this eliminates the risk. Huger acknowledges autonomous systems will make mistakes just as every other security technology does. The goal isn't to build an AI SOC that never makes the wrong decision.
It's to build one that makes as few mistakes as possible, limits the damage when they happen and helps organizations recover from them. And that may require security leaders to rethink their expectations around human oversight.
Some organizations won't be able to remove humans from certain decisions because of regulatory, governance or operational requirements. Others will simply have a lower tolerance for autonomous action.
But attackers don't have to respect any of those constraints.
As AI compresses the time between reconnaissance, exploitation and lateral movement, defenders may increasingly find that the decision window is shorter than their approval process.
Huger thinks that shift could happen quickly.
"I don't think you'll be able to wait for human in the loop," he said. "I think that's going to be very quickly a thing of the past."
Whether that happens this year, next year or further out, the direction of travel raises a question security leaders need to start answering now.
If your AI SOC had to act before one of your analysts could approve it, what would you trust it to do?
And just as importantly, what have you built around it to make sure one bad decision doesn't become the next incident?
