AI can triage an alert; the incident still needs a defensible decision

Recent NCSC work and a task-specific phishing-triage trial suggest testing the complete analyst handoff before giving AI greater response authority.

A security analyst rarely needs another polished paragraph announcing that something looks suspicious. The useful output is a decision that can be checked: which evidence supports the concern, which explanation remains possible, what the organisation can safely do next and who has authority to do it.

AI can help assemble that material. Whether it improves a security operation depends on the task around the answer. A faster initial verdict can still create more work if analysts must reconstruct its sources, reverse unnecessary containment or discover that important cases were omitted from the queue. The right trial follows the decision through its handoff.

A 2026 ambition with work still to do

In its [7 July 2026 account of Cyber Shield](https://www.ncsc.gov.uk/blogs/cyber-shield-the-path-to-an-agentic-ai-future-for-cyber-defence), the UK's NCSC describes a blueprint being developed with DSIT for national-scale agentic cyber defence. The page sets out ambitions for detection, mitigation and collaboration while acknowledging research and delivery challenges. It is a programme vision, not a published demonstration that autonomous defence already works across every participating organisation.

That distinction is useful for a much smaller security team. It can investigate specific assistance today without making a fleet-wide automation promise. A proposal to summarise evidence for a human reviewer has a different operational consequence from a proposal to change production access automatically.

Start with a real decision shape

Imagine a fictional maintenance-services company in Johannesburg testing a helper against synthetic login alerts. No actual company or incident is described. The assistant receives a permitted subset of invented records and prepares an evidence note. It cannot disable accounts, contact employees or change a monitoring rule.

The team defines the note before evaluating the model. It must identify the event being reviewed, distinguish observed facts from an explanation, link to the source records and state what is missing. The analyst then records a decision separately. This gives the organisation something to compare even when two generated summaries use different wording.

One fictional alert involves an employee travelling. Another contains a similar pattern with contradictory device evidence. The exercise asks whether the helper exposes the contradiction rather than smoothing it into a single persuasive story. The aim is useful uncertainty, expressed at the point where it changes the next action.

Read productivity research at its actual scale

[James Bono's November 2025 paper on a Microsoft Security Copilot phishing-triage agent](https://arxiv.org/abs/2511.13860) reports a randomised controlled trial with improvements in analyst productivity and verdict accuracy under the study conditions. The paper attributes benefits to queue prioritisation and explanations, among other observations. Those findings concern a particular agent, task and experimental design.

They do not establish a universal staffing ratio or guarantee that the fictional company's login-alert process will improve. A local trial needs to specify its own workload, comparison condition, permitted data and review standard. It should also record what analysts must do after an initial verdict, since operational work does not end when a classification appears.

If the company later considers a vendor product, it should examine the matching feature and release rather than attaching an old research result to an unrelated new offering. A product name can persist while its workflow changes.

Count outcomes that include mistakes

For the fictional trial, the review team first agrees how to label the synthetic cases and how to resolve disagreement. It keeps some cases outside the material used to develop the prompt. Analysts inspect both raised concerns and apparently ordinary cases; otherwise, a quiet queue could conceal missed problems.

The comparison follows correct decisions, missed cases, unnecessary escalations, review time and recovery work. These are proposed measurements, with no numerical results claimed here. The organisation should publish the denominator and treatment of unresolved cases when reporting its own trial. Removing difficult examples after seeing the answers would make the comparison less informative.

The team's question is practical: does assistance improve the complete handoff for this workload? A model that helps a new analyst find a source may be useful even if it should never choose containment. A model that produces a confident but untraceable conclusion may require more supervision than the team can provide.

Change authority is a different problem

The [NCSC's 21 September 2026 discussion of agentic defence](https://www.ncsc.gov.uk/blogs/one-does-not-simply-defend-agentically) emphasises organisational constraints and proposes considering the potency, scope, criticality, rollout confidence and recoverability of a defensive action. It is a framework for judging the action, rather than a claim that every technically possible response should be automated.

In the fictional company, an analyst's evidence note and an account-lock operation therefore have separate acceptance criteria. The latter requires a clearly bounded target, an accountable decision, a supported reversal process and a way to observe the result. An AI-generated recommendation does not supply that authority on its own.

A useful rehearsal includes a legitimate user who would be affected by the proposed action. The team can then examine operational impact without inventing an incident or treating a harmless test as permission to interfere with another person's account.

Preserve the evidence through the handoff

[NIST SP 800-61 Revision 3, finalised in April 2025](https://csrc.nist.gov/pubs/sp/800/61/r3/final), places incident response within cybersecurity risk management through a CSF 2.0 community profile. Its scope reinforces a broader view than isolated alert classification: preparation, response and recovery need to fit the organisation's risk-management activities.

For the fictional workflow, the handoff contains the source references, the model-assisted note, the human decision and any authorised action's outcome. Access to those records follows their sensitivity. The team does not paste private investigation material into an unapproved assistant simply because summarisation is convenient.

If the model changes its mind on a later run, retain the earlier note rather than overwriting the history. The reviewer needs to understand what supported the decision at the time. A later, better explanation does not retroactively become the basis of an earlier action.

Keep the role that earns its place

The company can expand the helper's role when the evidence supports it, or keep it as a source-finding and drafting tool. Either decision can be sensible. The important result is a tested account of where assistance helps, which mistakes remain and who carries the operational responsibility.

This is defensive educational reporting, not an incident-response certification or vendor endorsement. The company, alerts and proposed measurements are fictional. No analyst trial, security product or account action was executed for this article. Sources were checked on 15 October 2026.

Evidence diagram and readable guide


Original explanatory diagram: assistance and independent review feed a human decision before a separately authorised action.

[Open the complete evidence diagram](/assets/cyber-workflow-soc-evidence-handoff-20261015.svg)

Read the diagram

**Evidence supports a human decision**

Assistance and review contribute separately to the decision. This is a fictional trial design, with no measured productivity or detection result.

- **Synthetic alert set.** Define cases and hold back comparisons before tuning.

- **AI-assisted evidence note.** Link observations and mark contradictory or missing evidence.

- **Independent review.** Inspect ordinary cases as well as raised concerns.

- **Human decision.** Record responsibility and the reason for the decision.

- **Scoped authorised action.** Review effect, scope, criticality and reversal separately.

- **Outcome and recovery record.** Include errors, review effort and uncertain results.

The dashed branch is the independent comparison path. Assistance and review meet at a human decision, not a measured productivity or detection outcome.

How the connections work

- Synthetic alert set to AI-assisted evidence note: input; solid directed link. Proposed input relationship; no measured causal effect.

- Synthetic alert set to Independent review: comparison; dashed directed link. Proposed comparison relationship; no measured causal effect.

- AI-assisted evidence note to Human decision: proposal; solid directed link. Proposed proposal relationship; no measured causal effect.

- Independent review to Human decision: review; solid directed link. Proposed review relationship; no measured causal effect.

- Human decision to Scoped authorised action: approval; solid directed link. Proposed approval relationship; no measured causal effect.

- Scoped authorised action to Outcome and recovery record: outcome; solid directed link. Proposed outcome relationship; no measured causal effect.

Keep the paths separate

AI-assisted evidence and independent review contribute separately; there is no arrow from one branch to the other.