What should never be automated?
Dec 10th, 2025 by Jesper Kråkhede
This year I have written a lot about automation and AI. Let me end with the opposite question: what should never be automated?
I don´t mean never in the absolute sense. Technology moves fast. But today, I would keep a human in the loop for a few things.
Actions that can´t be undone. Deleting data, wiping devices, removing accounts permanently. Automate the preparation, but let a person press the button.
Actions with large business impact. Isolating a critical production server, shutting down a factory network, blocking a whole country. The machine may be right, but the cost of being wrong is too high.
Decisions about people. Firing, hiring, disciplinary actions, access to services people depend on. These need human judgement and human accountability, and in many cases the law requires it.
Changes to the security controls themselves. An agent that can turn off logging, change Conditional Access policies or give itself more rights is an agent an attacker would love to control.
And anything where you don´t understand why the system made its decision.
For everything else, automate as much as you can. Isolation of a normal workstation, enrichment, triage, password resets after risky sign ins, removal of phishing mails. The more of the routine the machines handle, the more time the humans have for the decisions that matter.
Automate the speed. Keep the judgement.