This year I have written a lot about automation and AI. Let me end with the opposite question: what should never be automated?<\/p>\n
I don\u00b4t mean never in the absolute sense. Technology moves fast. But today, I would keep a human in the loop for a few things.<\/p>\n
Actions that can\u00b4t be undone. Deleting data, wiping devices, removing accounts permanently. Automate the preparation, but let a person press the button.<\/p>\n
Actions with large business impact. Isolating a critical production server, shutting down a factory network, blocking a whole country. The machine may be right, but the cost of being wrong is too high.<\/p>\n
Decisions about people. Firing, hiring, disciplinary actions, access to services people depend on. These need human judgement and human accountability, and in many cases the law requires it.<\/p>\n
Changes to the security controls themselves. An agent that can turn off logging, change Conditional Access policies or give itself more rights is an agent an attacker would love to control.<\/p>\n
And anything where you don\u00b4t understand why the system made its decision.<\/p>\n
For everything else, automate as much as you can. Isolation of a normal workstation, enrichment, triage, password resets after risky sign ins, removal of phishing mails. The more of the routine the machines handle, the more time the humans have for the decisions that matter.<\/p>\n
Automate the speed. Keep the judgement.<\/p>\n","protected":false},"excerpt":{"rendered":"
This year I have written a lot about automation and AI. Let me end with the opposite question: what should never be automated? I don\u00b4t mean never in the absolute sense. Technology moves fast. But today, I would keep a human in the loop for a few things. Actions that can\u00b4t be undone. Deleting data, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[165,110,191],"class_list":["post-1492","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-ai","tag-automation","tag-human-in-the-loop"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1492","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1492"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1492\/revisions"}],"predecessor-version":[{"id":1497,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1492\/revisions\/1497"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}