Cybersecurity is often described as a technology problem until an incident reveals that it is also a process problem. Alerts arrive, systems disagree, ownership becomes unclear, approvals slow down, and people discover that a recovery plan existed on paper but not in daily operations.
The arrival of more capable AI makes this gap harder to ignore. On 27 August 2026, Reuters reported that more than 100 technology and financial companies called for a broad defensive effort against AI-driven cyberattacks. The concern is not simply that AI can create malicious content. It can help attackers research targets, adapt techniques, automate repetitive steps, and operate at a speed that compresses the time available for human response.
The practical question for enterprises is therefore not whether to buy another security tool. It is whether the organisation can detect, decide, act, recover, and learn as one coherent system.
Speed exposes weak handoffs
Many security workflows depend on handoffs between monitoring teams, infrastructure, application owners, identity teams, legal, communications, vendors, and business leaders. Each group may perform well inside its own boundary, yet the end-to-end response can still fail.
An alert may be technically accurate but lack business context. A system owner may know the operational impact but not have authority to isolate it. A high-risk account may remain active while two teams debate ownership. A vendor may need approval before sharing logs. A communication team may prepare a statement without a verified timeline.
AI-assisted attacks increase the cost of these delays. When the threat can change faster, ambiguous ownership becomes a vulnerability.
This is where Business Analysis and Product Management become relevant. Security operations need the same discipline as any critical product: defined users, clear journeys, prioritised requirements, observable states, service levels, exception paths, and measurable outcomes.
Treat defence as a workflow, not a collection of tools
A resilient workflow begins before the alert. The organisation should know which assets are critical, which identities hold sensitive privileges, which data may be exposed, and what business impact follows from interruption.
Detection then needs context. A thousand alerts with no prioritisation do not create awareness; they create fatigue. The system should combine technical severity with asset criticality, user role, data sensitivity, known exposure, and confidence in the signal.
Decision rights must also be explicit. Who may disable an account? Who may isolate a server? Which actions can happen automatically? Which require approval? What is the fallback when the authorised person cannot be reached?
Finally, every response needs evidence. Teams should preserve what was observed, what action was taken, who approved it, what changed, and whether the action worked. Without that trail, post-incident learning becomes memory and opinion.
Automation needs boundaries
AI can strengthen defence by correlating signals, summarising events, proposing containment steps, generating queries, and helping analysts investigate faster. But defensive automation has its own risks. A wrong action can interrupt legitimate operations, lock out critical users, or destroy evidence.
The safest approach is progressive authority.
At the first level, AI observes and summarises. It may collect evidence but cannot change production.
At the second level, it recommends actions with the supporting rationale and expected impact.
At the third level, it performs low-risk, reversible actions under defined conditions—such as enriching an alert or temporarily increasing monitoring.
At higher levels, it may execute containment steps, but only after performance, auditability, and escalation controls have been proven.
Authority should expand because evidence supports it, not because the demonstration looked convincing.
UAT for security must include pressure and uncertainty
Security acceptance testing cannot stop at whether an alert appears. Teams need scenario-based exercises that test the full response.
Create conflicting signals from two monitoring sources. Remove a key decision-maker. Simulate a compromised administrator account. Introduce a vendor outage during investigation. Test a false positive on a revenue-critical system. Delay log delivery. Trigger two incidents at once.
Then evaluate behaviour. Did the right team receive the case? Was the severity understandable? Could the responder see the business context? Did approvals match the risk? Were automated actions reversible? Did the system preserve evidence? Could leaders obtain a reliable status without interrupting analysts?
The useful metrics go beyond time to detect. Measure time to classify, time to assign an accountable owner, time to contain, percentage of alerts closed without sufficient evidence, rate of repeated incidents, unnecessary disruption from false positives, and completion of corrective actions.
Human oversight must be operationally meaningful
“Human approval required” sounds safe, but it can become an empty control when reviewers lack context or face too much volume. A meaningful approval screen should explain the affected asset, reason for escalation, confidence level, proposed action, potential business impact, reversibility, and evidence used.
High-risk actions may require separation of duties. Low-risk actions may be approved through policy and monitored by sampling. Emergency procedures may allow immediate containment with mandatory retrospective review.
The objective is not to insert a person into every click. It is to place accountable judgement at the points where error would be costly or irreversible.
Cyber resilience is a product outcome
An organisation is not resilient because it owns advanced tools. It is resilient when people understand their roles, systems share reliable context, decisions happen within useful time, actions leave evidence, and lessons change the operating model.
This mindset also changes the roadmap. Instead of listing tool deployments, the roadmap can target reduced identity exposure, faster ownership assignment, tested recovery for critical services, fewer unactionable alerts, and higher completion of remediation work.
Cybersecurity then becomes part of digital transformation rather than a gate added at the end. New products can include threat modelling, identity boundaries, logging requirements, recovery objectives, and incident ownership from the start.
AI will increase both offensive and defensive capability. The lasting advantage will not come from assuming that one side has the smarter model. It will come from operational clarity: knowing what matters, who decides, what may be automated, and how the organisation learns under pressure.
The strongest defence is not a single wall. It is a system that can keep making good decisions while the situation changes.
**Discussion:** If a critical cyber alert arrived tonight, which decision in your organisation would take longest—and why?
Sources
- [Reuters — Major technology companies call for a defensive surge against AI-driven hacks, 27 August 2026](https://www.reuters.com/legal/litigation/major-tech-companies-call-defensive-surge-defeat-ai-driven-hacks-2026-08-27/)
- [Gartner — Top Strategic Technology Trends for 2026](https://www.gartner.com/en/articles/top-technology-trends-2026)