Myth #8: AI Should Make Cybersecurity Decisions Completely Autonomously

Break the Myth #8

Myth: AI Should Make Cybersecurity Decisions Completely Autonomously

Reality: The strongest cybersecurity combines AI automation with meaningful human oversight.

Artificial Intelligence is transforming cybersecurity by enabling organizations to analyze enormous volumes of security data, detect anomalies, correlate threats, identify attack patterns, and recommend responses at speeds that would be impossible for human analysts alone. However, this does not mean that every cybersecurity decision should be delegated entirely to AI.

Some cyber response actions can have significant operational, financial, privacy, and even safety consequences. An incorrect automated decision could interrupt essential services, disconnect legitimate users, disrupt business operations, or—in healthcare environments—affect systems supporting patient care.

Consider actions such as:

• Isolating a hospital server or clinical information system

• Quarantining an IoMT or connected medical device

• Blocking network communications

• Disabling a privileged user account

• Restricting access to critical infrastructure

• Shutting down a production or operational network

• Automatically modifying firewall or access-control policies

• Initiating containment actions across multiple interconnected systems

  
  

These actions may sometimes be necessary, but high-impact decisions require context, accountability, and appropriate human oversight.

Within the AIAGENT4CYBER project, we are exploring how Multi-Agent AI, Knowledge Graphs, Large Language Models (LLMs), Explainable AI, and human oversight mechanisms can work together to support faster and safer cybersecurity decision-making.

Instead of simply asking AI to “detect and respond,” a human-centered cybersecurity system can determine the appropriate level of automation according to the risk, confidence, criticality, and potential impact of each decision.

For example, AI can autonomously perform low-risk and reversible activities such as:

• Collecting and correlating security events

• Enriching alerts with threat intelligence

• Mapping activities to MITRE ATT&CK

• Identifying relevant vulnerabilities

• Calculating contextual cyber risk

• Prioritizing incidents

• Recommending mitigation actions

• Generating incident summaries and explanations

  
  

However, when a proposed response could significantly affect critical infrastructure or healthcare operations, human expertise should remain central to the final decision.

Human-in-the-Loop

With Human-in-the-Loop (HITL) control, AI analyzes the situation and recommends an action, but a cybersecurity professional must review and approve it before execution.

For example:

AI detects threat → analyzes context → explains evidence → recommends device isolation → analyst reviews → analyst approves/rejects → action executed

This approach is particularly important when dealing with critical IoMT devices, EHR systems, hospital networks, privileged accounts, and other safety-critical assets.

Human-on-the-Loop

Not every cybersecurity action requires prior approval. Human-on-the-Loop (HOTL) approaches can allow AI to perform predefined, low-risk automated actions while cybersecurity professionals continuously supervise system behavior and retain the ability to intervene, modify policies, or stop automated responses.

The appropriate level of autonomy can therefore depend on factors such as:

• AI confidence

• Threat severity

• Asset criticality

• Potential business or clinical impact

• Reversibility of the proposed action

• Quality of supporting evidence

• Organizational security policies

  
  

For example, automatically enriching an alert with CVE, EPSS, and threat-intelligence information presents very different operational risks from automatically disconnecting a medical device supporting a critical clinical workflow. The objective should therefore not be maximum automation, but appropriate automation.

A trustworthy AI system should also explain why it recommends an action. Before approving a high-impact response, analysts should be able to understand:

What was detected?

Which assets are affected?

What evidence supports the conclusion?

How confident is the AI?

What attack path has been identified?

What could happen if no action is taken?

What are the potential consequences of the recommended response?

This is where Knowledge Graphs and explainable Multi-Agent AI become particularly valuable. They can provide the contextual evidence behind recommendations, allowing analysts to make informed decisions rather than simply accepting opaque AI-generated commands.

Human oversight also creates an important feedback loop. Analysts can confirm or reject AI recommendations, correct inaccurate conclusions, and provide operational knowledge that can be incorporated into future system improvement.

The future of cybersecurity is therefore not about giving AI unlimited authority.

It is about creating human-centered AI systems in which machines provide speed, scalability, continuous monitoring, and data-driven reasoning, while people provide judgment, accountability, organizational context, and control over high-impact decisions.

AI can recommend. AI can prioritize. AI can automate appropriate tasks. But humans should remain accountable for decisions that can significantly affect people, organizations, and critical infrastructure.

Where should we draw the line between autonomous AI response and mandatory human approval in cybersecurity?