The Analyst Stays in the Loop
AI agents can close most alerts faster than any SOC shift. Deciding what an alert means for the business, and owning that call, is still a human job.
7 min read
Threat models, incident write-ups and the judgment calls automation cannot make.
3 stories
AI agents can close most alerts faster than any SOC shift. Deciding what an alert means for the business, and owning that call, is still a human job.
Threat modeling works best as a structured argument between the people building a system. A worked password-reset example, with STRIDE and the four questions.
Once an LLM can call tools, prompt injection stops being a chatbot quirk and becomes a path to your data. Practical controls, and where human review is mandatory.
You’re all caught up.
Something on your mind? Write it down, or show me something amazing.