Security at machine speed: Where does the human sit?

Cybersecurity at machine speed is redefining the role of human oversight

As AI accelerates both cyberattacks and automated defence, security leaders face a new question: when machines can detect, decide and respond faster than humans, where should human oversight sit?

When automated remediation contains a breach before a security analyst even sees the alert, cybersecurity officially outpaces human reaction time.

But machine-speed defence creates a high-stakes executive dilemma: if software executes critical decisions faster than people can evaluate them, where does operational authority end, and who bears the ultimate accountability?

During a recent HotTopics C-Suite Exchange, in partnership with Red Hat and recorded under the Chatham House rule, technology and security leaders debated the scope of the ongoing shift, aligning IT and SOC operations, readiness for internal risk threats in the face of AI, and the level of human oversight.

Massive transformation vs. gradual shift of the operating mode

The conversation started with a poll on whether the rising threat of AI-driven or AI-discovered attacks requires a fundamental shift in the security operating model.

In general, the majority of participants agreed that the sweet spot is somewhere between actively shifting the security operating model and evolving security processes and internal skill sets.

One panellist opened the discussion with the notion that organisations require a sizable transformative shift because AI doesn't discriminate against the size of the company. Everybody is vulnerable, some more than others due to the inner infrastructural complexity of preventing these AI-driven attacks.

Quickly, the attention turned to boardrooms and their cognisance of the situation at hand. For some, the recent incidents with Claude Mythos and OpenAI agents provided the much-needed catalysts to kickstart the shift.

While high-profile agentic AI incidents have raised executive awareness, sectors that revolve less around IT as their core business still struggle to grasp emerging attack vectors, often viewing AI through an efficiency lens rather than a risk management one.

As a participant from the world of football and the Premier League, specifically, said:

“We're working with a lot of partners to make sure that we're not falling behind or being second. We're also definitely trying to run before we can walk with AI. Despite the good things, doing so creates quite a lot of internal risk around adoption, data protection, governance, and so on.”

One tech executive offered an interesting tidbit: 100 percent of any vulnerabilities an organisation has now are going to be exploitable and breachable with AI, largely due to how AI brings in concurrency to threats.

The panel agreed that something must be done now to prepare for the future, as opposed to waiting for an incident to happen and react (which is what usually occurs in most cases, sadly).

Prioritisation and the nuanced realities of a quick and precise response weren’t lost on one of the participants, who noted:

“As those leading the shift, we have to help our team prioritise how urgently they have to process a patch. We have to let everyone involved know that things are going to get messy at all levels, but that we're doing it for the best of reasons.” 

Danger levels of internal vs. external threats

The discussion then shifted to how AI changes boardroom thinking in regard to the internal threat level because of shadow IT, negligence, and deliberate action.

One panellist underscored that the internal threat is very much a clear and present danger. It's just that the way it's moving across the landscape has changed.

To that extent, security awareness in the boardroom is much higher with AI than it was with cloud adoption, as the one comparable event in terms of technological impact.

Here, the dialogue steered toward trust.

The primary friction lies between AI's implied trust models and enterprise Zero Trust architectures. Non-human identities, specifically autonomous AI agents, are rapidly becoming primary threat vectors. Because they often take shortcuts to achieve outcomes, securing them requires rigid identity governance.

As such, identity is one of the most critical things the cybersecurity industry has to solve.

If an AI agent issues a system command, security teams must verify its identity and permissions, whether inferred or inherited from the user. Without strict machine identity governance, zero trust breaks down.

Human oversight in a machine-speed world

The final part of the conversation focused on where a human sits in all of this.

“Ultimately, we want to get to a state where we don't need human relief unless it’s called for,” one executive said.

The question remained whether the human in the loop can keep up with the pace and the volume moving forward. For some, it’s an evolving thinking process that will inevitably vary by industry depending on the location, level of regulation, type of infrastructure, etc.

Arguably, the maturity of the technology will play a major role here. There are certain critical systems that, ideally, would require only human oversight. But as the technology matures, that bar will likely be lower in the years to come than it is at the moment.

Finally, a representative from Red Hat closed the session with a stark metric: there was a 250% surge in vulnerabilities over the past year. As threat actors leverage machine speed to exploit these flaws, an organisation’s defence can no longer rely on human response times.

In partnership with Red Hat