Flight training is built on a simple arrangement: the machine can fly the profile, but the instructor decides when the student may attempt it, and the evidence for that decision is logged. Security teams adopting machine learning could borrow the whole syllabus. The questions below come from real conversations with training organisations beginning to evaluate AIOps for Security tooling — an emerging label, still without a formal standard, for ML- and LLM-based assistance across security operations work. The answers lean on the published evidence rather than vendor optimism, because in this field the evidence is unusually clear about how much trust each capability level has earned. Treat the section headings as the questions your own team will ask in its first month of evaluation.
What Does Autonomy Mean in AIOps for Security?
Autonomy is granted per action class, never per product. The ladder runs from L0, pure observation, through L1, recommendations a human reviews, to L2, silent closing of genuinely benign cases, then L3, where software may take reversible steps — suspending a session or forcing a credential reset — and finally L4, irreversible moves, which stays permanently off-limits. A vendor whose assistant closes mail unsupervised has not “enabled a feature”; it has claimed a specific rung, and that claim carries a specific evidentiary debt. Asking “what rung is this?” in a demo converts a vague conversation about intelligence into a checkable statement about authority. In practice the lower rungs already deliver most of the relief an overworked team wants — scoring, sorting, drafting a case summary for a human to accept — while the upper rungs multiply both value and risk. It also exposes mixed products quickly: one tool may deserve recommendation rights on phishing while failing outright on identity anomalies, and the ladder forces that distinction into the open rather than letting an average hide it.
How Much Evidence Does Each AIOps for Security Rung Demand?
The rungs price themselves in graded cases. Recommendations may begin once the system has studied roughly two hundred graded alerts, thirty-plus of them confirmed genuine. Silent closing costs far more: misses must be demonstrably under two percent across at least one hundred fifty confirmed genuine alerts, decoy cases planted in production, a held-out set scored blind, and a one-click reopen path live from day one. Reversible actions price highest of all — wrong-action rates under one percent across more than three hundred verdicts where acting would have been correct, a rollback that has been rehearsed rather than promised, and hard caps on volume. Every step is auditable by someone who was not in the vendor meeting, which is the point. Where the numbers are missing, the honest conclusion is not “probably fine” but “unproven”, and unproven rungs stay ungranted.
Why Did a Strong Trial Still Fail Its Gate?
Because strong and proven are different measurements. In the documented triage assessment, an agent handled 1,240 emails whose true status had been fixed in advance by humans; seventy-one were genuine threats, and the agent overlooked two — a raw miss rate of 2.8%. The confidence ceiling on so few genuine cases stretched to about 8.6%, far above the two-percent requirement, so autonomy was refused even though closing precision hit 99.8% and analysts could have shed 93.5% of their workload. The same evaluation exposed a subtler trap: the agent’s self-declared “genuine” verdicts carried only 86% precision, meaning its own confidence labels were considerably softer than its clean-up record suggested. Flight instructors know this shape well — a student who lands smoothly ninety-nine times has not demonstrated what happens on the hundredth, and the syllabus counts the hundredth, not the ninety-nine.
Can We Simply Quote the Vendor’s Accuracy Figure?
No, and the reasons are structural rather than rude. Published figures describe someone else’s traffic mixture, someone else’s attackers, and someone else’s labelling habits; none of that transfers intact to your mail flow or your identity infrastructure. The research record adds a harder warning: scores approaching a perfect 1.0 in security ML usually mark evaluation bias — leaked or unrepresentative test data — rather than excellence, a pattern documented across the TESSERACT studies and the Arp et al. survey of thirty leading papers. Gartner’s 2026 hype-cycle placement of AI SOC agents and its “AI washing” warning both describe the market this creates. The substitute question is simple and uncomfortable: label a few hundred of your own recent cases, have the product judge them blind, and let your bound decide. Three asks belong in every first meeting: the sample sizes behind any quoted figure, the per-category breakdown rather than a pooled average, and the observe-only switch — or an admission that none exists. Vendors who welcome that exercise are rare and worth shortlisting; vendors who answer with a case study are answering a different question.
What Does Verification Look Like Once the System Runs?
Post-deployment checks fail quietly when they rely on random sampling. Review one in twenty of about 1,845 closures from the quarter, discover nothing, and the genuine miss rate can still approach 38% — a finding indistinguishable from never having audited at all. Verification therefore plants its evidence: fifty canary cases a quarter, each a genuinely malicious sample the agent should escalate, with an explicit withdrawal rule once three or more get closed. Add drift monitors for the day the traffic pattern shifts and a cost baseline so the programme can prove its savings rather than assert them. Nothing here is exotic. Every piece fits the same instinct as an instructor planting a simulated engine failure — the emergency you rehearse is the one you can score. An audit that only reads history will always flatter the system it audits, because history was written by the system under review.
Where Does the Human Stay Irreplaceable?
At the judgement layer, permanently. MITRE’s rebuttal to the “AI will run the SOC” pitch holds that a person must evaluate what the machinery produces — the machine may sort, but the human owns the verdict. Anomaly outputs deserve special scepticism, since most flagged oddities turn out to be ordinary change: new starters finding their feet, new tools being installed, routines shifted by a reorganisation. Treating those as incidents teaches staff to ignore the channel that will one day carry the real warning. Prompt-injection risk caps the ceiling too; the NCSC’s December 2025 analysis explains why agents reading attacker-controlled text cannot be made safe by filtering alone — instructions and data arrive in one indistinguishable stream, and rewording defeats blocklists indefinitely. Its verdict describes the model as an inherently confusable deputy and recommends deterministic guards with least privilege instead. The aviation parallel is exact, and readers of AI-driven aircraft engine health monitoring will recognise it — the analytics flag, the licensed engineer signs. Autonomy extends reach; it never transfers responsibility.
How Should a Training Organisation Begin?
Slowly, and on paper first. The maturity path runs from ad hoc through measured — blind shadow scoring against exported dispositions — to governed, where a signed register and an action gate decide what may run, then adversarial, where purple-team decoys and per-incident recall are tracked, and only then to learning systems. A first quarter fits in three moves:
- Export and label what already happened, then shadow-score two alert categories with the labels hidden from the system.
- Hold monthly per-category reviews and write the gate values down, signed, before any autonomy is discussed.
- Plant the first decoys, stand up drift monitors, and record what an analyst hour actually costs.
Organisations weighing a purchase can also score themselves on the published 27-point decision rubric — totals above 14 justify shadow mode, 9 through 14 a pilot with a fixed end date, anything lower a polite refusal. The full syllabus, including the rung definitions used above, sits in the Ops Atlas syllabus for AIOps for Security. And the same graduated-trust logic applies to any unfamiliar operator — it is why cautious students check an operator’s credentials first, exactly as advised in this practical guide to renting bikes, scooters and cars in India. Trust is issued per rung, after evidence, never before.