AI Can Make the Decision Faster. It Cannot Own the Decision.

AI is moving rapidly from being a tool that answers questions to systems that analyse information, recommend actions, and increasingly execute tasks. In cybersecurity, that shift is particularly significant. Security teams are already using AI to investigate alerts, summarise incidents, analyse vulnerabilities, generate queries, identify patterns, and support response activities.

The next stage is more complex. Organisations are no longer dealing with a single AI system. They are beginning to operate environments where multiple models, agents, security tools, and automated workflows interact with one another. Gartner expects 40% of enterprise applications to feature task-specific AI agents by the end of 2026, compared with less than 5% in 2025. Gartner also expects one-third of agentic AI implementations to combine agents with different skills by 2027. 

That changes the cybersecurity question.

It is no longer simply “How accurate is the AI?” The more important question is “How should AI and human expertise work together when the decision carries business, security, regulatory, or operational consequences?”

The AI problem is no longer a single-AI problem

Traditional AI adoption often involved one model supporting one particular task. A security analyst might use an AI assistant to summarise an incident or generate a detection query. The analyst remains responsible for interpreting the output and deciding what to do next.

Multi-agent environments introduce another layer of complexity. Different AI systems may specialise in threat intelligence, vulnerability analysis, identity, cloud security, compliance, or incident response. They can potentially exchange information and act on one another's outputs.

Gartner identifies multiagent systems as an emerging design pattern for distributed decision-making, while also highlighting the engineering complexity and governance risks associated with them. 

This means that an organisation cannot evaluate AI only at the model level. It needs to understand how multiple AI systems interact, what information they rely on, what decisions they influence, and where human accountability remains necessary.

Accuracy is not the same as reliability

One of the most common questions around AI adoption is, “What percentage accurate is the AI?”

There is no single percentage that can answer that question across cybersecurity. Accuracy depends on the model, dataset, task, environment, prompt, context, evaluation methodology, and the consequences of an incorrect answer.

The evidence we do have shows that AI can materially improve human performance in specific security tasks. Microsoft's randomized controlled study of experienced security professionals found that analysts using Copilot for Security were 22% faster and 7% more accurate across the tested tasks. 

That statistic is important, but it is often interpreted incorrectly. It does not mean that Copilot itself is 7% or 22% accurate. It measures the change in human performance when people use the AI system.

A separate longitudinal study of 45 SOC analysts, covering 3,090 analyst queries over 10 months, found that analysts primarily used LLMs for sense-making and context-building rather than for high-stakes determinations. The researchers concluded that LLMs functioned as cognitive aids that augmented, rather than replaced, SOC expertise. 

The distinction matters. AI performance and human-AI performance are two different measurements.

The human is not the weak link

There is a tendency to describe human involvement as something AI should eventually eliminate. In cybersecurity, that is the wrong framing.

A security decision rarely exists in isolation. A technically correct recommendation may still be the wrong business decision because of operational dependencies, regulatory obligations, customer impact, contractual commitments, or the organisation's risk appetite.

An AI system can identify that a vulnerability is exploitable. A human may know that the affected system supports a critical business process that cannot be taken offline immediately. An AI system can recommend blocking an account. A security leader may know that the account belongs to a critical operational function and that a controlled investigation is more appropriate.

The value of the human is therefore not simply in correcting AI mistakes. It is in providing context, accountability, judgement, and an understanding of consequences that may not exist in the underlying data.

The real question is where the human enters the decision

“Human in the loop” sounds simple, but it can be implemented badly.

If humans are required to review every AI-generated decision, the organisation can simply recreate the manual process it was trying to automate. Reviewers become overloaded, decisions slow down, and the human eventually starts approving recommendations without sufficient scrutiny.

Gartner's current guidance makes this point directly. Human oversight remains non-negotiable, but indiscriminate oversight can create reviewer fatigue and reduce productivity. Gartner recommends determining where humans should intervene based on factors such as risk, reversibility, and confidence. 

The objective, therefore, should not be to keep a human involved in every action.

It should be to put the human at the right decision point.

Low-risk, repeatable, reversible actions can potentially be automated. High-impact or irreversible decisions should receive stronger human oversight. The governance model should determine that boundary before the system begins making decisions at scale.

Cybersecurity needs this distinction more than most functions

Cybersecurity is particularly sensitive to poor decision automation because the cost of a wrong decision can be immediate.

An automated system that incorrectly classifies an alert may allow an attack to continue. An overly aggressive response may disrupt a legitimate business process. An incorrect risk prioritisation may cause a team to spend resources addressing a lower-impact issue while a more consequential exposure remains unresolved.

This is why the objective of AI in cybersecurity should not simply be more automation.

It should be better decisions at greater speed and scale.

Research is increasingly examining this model of human-AI collaboration directly. A 2025 study of SOC analysts found that practitioners were already integrating LLMs into their workflows while retaining decision authority. Another 2025 meta-analysis covering 146 experiments across healthcare and public-sector decision-making found that AI augmentation improved human performance overall, but also found that AI alone sometimes outperformed human-AI teams. The researchers specifically caution against assuming that human-AI collaboration is automatically superior and support selective automation with human oversight for complex decisions. 

That is an important finding for cybersecurity leaders.

Adding a human to an AI workflow does not automatically make the workflow better. Designing the interaction properly does.

Decision intelligence is what connects the two

This is where cyber risk decision intelligence becomes important.

Security platforms can generate thousands of findings. AI can process those findings faster than humans. But processing more information does not necessarily produce a better decision.

Decision intelligence adds the layer between information and action. It brings together context, business impact, likelihood, exposure, dependencies, confidence, and available controls to determine what actually requires attention.

Instead of asking:

What did the AI find?

The organisation should be asking:

What does this mean for the business, what should we do about it, and how confident are we in that recommendation?

That distinction becomes even more important as AI systems begin making decisions on behalf of organisations. Gartner has described decision intelligence as a way to move beyond insights toward decisions that are defined, governed, and operationalised. 

The role of AI is therefore not simply to produce an answer. It is to help build a defensible decision.

What happens when multiple AI systems work together?

Multi-AI environments introduce a new risk that organisations should begin considering now: decision chains.

One AI system may classify an asset as critical. Another may assess its vulnerability. A third may evaluate the likelihood of exploitation. A fourth may recommend remediation. If these outputs feed one another, an error at the beginning of the chain can influence decisions further downstream.

The issue is no longer only whether each individual model performs well. Organisations also need to understand how decisions propagate across the system.

This creates a requirement for observability, traceability, confidence assessment, clear decision ownership, and governance across the entire workflow.

The human therefore becomes particularly important at points where multiple AI outputs converge into a consequential decision.

The benefit of human plus AI is not simply better accuracy

The strongest argument for human-AI collaboration is not that humans will always be more accurate with AI than without it.

The stronger argument is that properly designed collaboration can allow each side to do what it is better positioned to do.

AI can process large volumes of information, identify patterns, correlate signals, generate hypotheses, and perform repetitive analytical work at machine speed. Humans can challenge assumptions, interpret business context, evaluate consequences, apply organisational risk appetite, and take accountability for consequential decisions.

Microsoft's research illustrates the potential of this combination: experienced security professionals using Copilot were faster and more accurate on the tested tasks, while 97% said they wanted to use it again. 

The goal is therefore not AI versus human.

It is AI for scale, human judgement for consequence.

Human-in-the-loop also needs governance

Human oversight itself cannot remain an informal process.

Organisations need to define who can approve an AI-generated recommendation, which decisions require escalation, what evidence must be available before a decision is made, when an AI action must be reversed, and how the decision can be reconstructed later.

This is especially important in regulated environments, where organisations may need to demonstrate not only what decision was made, but why it was made, what information influenced it, who was accountable, and what controls were applied.

Gartner's recent work on human-centred AI governance makes the same broader point: accountability does not disappear as decisions become automated. It must be deliberately preserved through the design of the operating model.

The future is not autonomous cybersecurity. It is governed autonomy.

The cybersecurity industry will continue moving toward more autonomous systems. That is inevitable.

The question is whether organisations will simply connect AI agents to more systems and allow them to make increasingly consequential decisions, or whether they will build the governance and decision architecture required to make that autonomy trustworthy.

The most mature organisations will likely do both. They will automate where automation creates measurable value, while deliberately retaining human authority where judgement, context, and accountability matter.

That is a much more practical definition of AI maturity.

Not how much the organisation has automated, but how confidently it can govern what has been automated.

Where we sit

At NMT Security, we see cyber risk decision intelligence as the layer that connects security data, AI-driven analysis, and human judgement.

The objective is not to replace the security team with AI. It is to give security leaders a clearer understanding of what matters, why it matters, what should happen next, and where human intervention is required.

As organisations adopt more AI systems, the volume of security information will continue to increase. The competitive advantage will not come from simply having more AI.

It will come from turning AI-generated intelligence into decisions that are explainable, prioritised, governed, and aligned with business risk.

The future of cybersecurity will be human and AI

AI will continue to become faster, more capable, and more autonomous. Humans will continue to provide the context, judgement, and accountability that consequential decisions require.

The organisations that get this balance right will not treat human involvement as a limitation on AI.

They will treat it as part of the architecture.

AI can identify the signal. AI can accelerate the analysis. AI can recommend the action. But when the decision has consequences, organisations still need someone who understands what that decision means.

That is where cyber risk decision intelligence becomes critical.