What remains for us?
Oct 7th, 2026 by Jesper Kråkhede
Agents now triage alerts, investigate incidents, find attack paths and propose fixes. Some of them act on their own. So what remains for the human analyst? I get that question from colleagues, from students and, honestly, from myself.
Let me try an answer.
Judgement. Deciding which risk to accept, which action is worth its business impact, when the textbook answer is wrong for this organisation. Agents can propose. Someone has to decide.
Context. Knowing that the CFO is travelling this week, that the factory is running a critical batch, that the supplier is in the middle of a dispute. Much of that context never ends up in a log.
Supervision. Watching what the agents do, catching their mistakes, improving their playbooks and moving their limits. That is a skill of its own, and it will be one of the most important ones.
The hard cases. The new attack technique, the insider, the incident that crosses organisations and countries. The agents will handle the routine so that humans can spend their time on these.
Communication. Explaining to management, customers and authorities what happened and what it means. Trust is still built between people.
And curiosity. The 500 milliseconds that someone found strange. The agents find what they are built to find. People find what nobody expected.
The job isn´t disappearing. It is moving up a level. The analyst who learns to work with agents will be more valuable than ever. The one who refuses will find that the routine work they protected is gone anyway.
Stop doing what the machine can do. Start doing what only you can.