Practice
Models can speed review of noisy security work. They should not be the last word on containment, account changes, or published findings.
Ranking alerts, clustering related events, summarizing tickets, drafting first-pass notes, and highlighting risky code patterns are legitimate applications when the original evidence remains available. Detection quality still depends on telemetry coverage and on people who can dismiss false positives.
Repetitive enrichment — looking up public indicators or formatting a report — is a fair use of automation. Automatic containment, privilege changes, or customer notification should remain gated. Monitoring without an on-call path and a runbook is noise.
AI can help search literature and organize notes. Research that touches systems you do not own still requires authorization from the owner. Generated “vulnerabilities” are hypotheses until a person verifies them against the actual system.
