AI makes human judgement more important, not less
AI, automation and increasingly capable decisionsupport systems are taking on more technical workload within cybersecurity. It is tempting to assume this reduces the importance of human capability. I don’ t think it does – I think it changes what we need people to be good at.
Increasingly, that means knowing when and how to exercise human judgement. As machines become better at detection, analysis and information processing, people still need to judge whether an automated recommendation makes sense in context. Decisions still have to be made about whether to act, what the wider consequences might be and when an output needs to be challenged. Effective response also depends on being able to explain those decisions and co-ordinate people when there is no obviously correct answer. These are precisely the capabilities most vulnerable to sustained pressure.
There is a potential problem, though. Increasing reliance on AI and automation may reduce the opportunities people have to exercise that judgement independently. Research on automation has long shown that over-reliance on technology can weaken independent judgement. More recent research into Generative AI raises a similar concern: when technology repeatedly does part of the cognitive work for us, the underlying human capability may not develop or may gradually erode.
This creates an uncomfortable paradox. Sustained pressure threatens the same capabilities that increasing reliance on automation may weaken. These two effects overlap at exactly the point where human contribution is becoming most valuable – judgement under uncertainty.
The question for cybersecurity leaders therefore isn’ t whether humans or AI will be better at particular tasks. It is whether organisations are deliberately developing the human capabilities they will still depend upon when automation has done everything it can.
Cybersecurity has become very good at preparing for incidents. The next step is to become equally deliberate about preparing the people who will have to manage them. Cognitive readiness is part of that preparation, and it cannot be developed once a major incident is already underway. The window to build it is every week that isn’ t one.
40 WWW. INTELLIGENTCISO. COM