{"id":5258,"date":"2026-11-02T04:50:00","date_gmt":"2026-11-02T04:50:00","guid":{"rendered":"https:\/\/www.devopssupport.in\/blog\/?p=5258"},"modified":"2026-11-02T04:50:00","modified_gmt":"2026-11-02T04:50:00","slug":"security-ai-six-myths-retired","status":"publish","type":"post","link":"https:\/\/www.devopssupport.in\/blog\/security-ai-six-myths-retired\/","title":{"rendered":"AIOps for Security: Six Myths Worth Retiring"},"content":{"rendered":"

Nobody said it out loud until the third coffee of the incident bridge, and then somebody finally did: “if the AI is closing the alerts, why are we paying six of you?” The room went quiet, which is what happens when a myth meets a payroll. AIOps for Security has collected more myths in two years than most fields manage in a decade, and each one sounds plausible in a standup and costs real money in production. Here are the six we hear most often, taken one at a time, with the evidence that retires each of them for good.<\/p>\n

Myth one: AIOps for Security means the machine runs the SOC<\/h2>\n

The strongest version of this myth comes from the vendors, the weakest from tired analysts, and both fall to the same fact: every serious evaluation framework keeps a human answerable for judging what the machinery produces. MITRE’s guidance is explicit on the point \u2014 a person evaluates the output \u2014 and the autonomy ladder used across the field caps out before irreversible actions for precisely this reason. Software may recommend, may close alerts under demonstrated bounds, may even take reversible actions within tested limits. It does not get the keys to the destructive closet, and it does not get the responsibility that goes with them. The six analysts stay; the six analysts just stop drowning. That outcome \u2014 people doing judgement work on top of machine-sorted queues \u2014 is the realistic best case, and it is worth defending in hiring plans now, before somebody budgets against the myth.<\/p>\n

Myth two: anomalous means malicious<\/h2>\n

This one dies in any estate within a week of honest shadow running. Watch what an anomaly detector actually flags: the CFO’s replacement laptop, a new hire’s first login from a new district, a supplier migrating mail platforms, a marketing team trying a new tool. Most anomalies are organisational changes and new people, not intruders \u2014 the field’s own documentation says as much. Teams that treat every anomaly as an attack burn out their responders and teach everyone to ignore the alerts, which is the worst of both worlds. The mature reading is calmer: anomalies are questions, and most of the answers are boring. Treating them as questions also tells you what to fix \u2014 the enrolment process that created the anomaly in the first place \u2014 which no amount of alert closing would have surfaced.<\/p>\n

Myth three: prompt injection is just input validation<\/h2>\n

The wishful thinking runs: filter the bad input, sanitize the request, problem solved. The UK’s NCSC closed this door in December 2025 with a piece titled, memorably, “prompt injection is not SQL injection” \u2014 because the model is not a database executing queries but an inherently confusable deputy, one that may never be fully mitigated at the model layer. What actually holds is architectural: deterministic guards around the agent, least privilege on everything it can touch, minimal outbound channels for anything that reads attacker-controlled text. Deny-lists fail by design, one rephrase at a time, because the space of paraphrases is inexhaustible and the attacker only needs one. If your agent can fetch a link and email a requester, assume the adversary writes both.<\/p>\n

Myth four: vendor accuracy travels with the box<\/h2>\n

Every procurement pack has the slide: ninety-something percent accurate, measured on real traffic. Measured on whose traffic, at what prevalence, labelled by whom \u2014 and would the answer survive a repeat next quarter? Accuracy demonstrably fails to transfer between estates, because prevalence and population shape the numbers more than model quality does. Gartner even has a name for the gap \u2014 AI washing \u2014 and the independent benchmarks give the flavour of honest measurement: agents finished only a quarter \u2014 25.2% \u2014 of the compliance-and-security scenarios in one 2025 suite, and scored in the twenties to fifties on malware and threat-intel reasoning in another. Those are useful tools having a useful day. They are not the brochure numbers, and pretending otherwise purchases surprises.<\/p>\n

Myth five: near-perfect scores mean near-perfect models<\/h2>\n

F1 around 0.99 should trigger an audit, not a purchase order. The TESSERACT studies, published between 2019 and 2022, took detector results in that range and watched them deflate as soon as spatial and temporal bias was removed from the evaluation \u2014 the models were partly memorising where and when events appear, not learning what attacks look like. A survey of thirty high-ranking security ML papers caught sampling flaws in nine of every ten, and test information leaking backwards into training choices in nearly three out of four. Peer review, the toughest filter academic work faces, still let those through. Marketing collateral faces no filter at all, so treat flawless numbers the way you would treat a CV written entirely in superlatives.<\/p>\n

Myth six: percent automated is the goal<\/h2>\n

The dashboard that shows “87% automated” tells you nothing you can defend, because automation percentage rewards the closure of everything, including the things a machine should never have touched. The metric that survives contact with an auditor is the pair: workload genuinely removed at a known error cost. One published triage evaluation manages this properly \u2014 93.5% of analyst toil assessed as genuinely removable, alongside the miss bounds and the precision figures that qualify it. Optimise for that pair and the automation lands where it belongs, at a speed the evidence can justify. Optimise for the percentage and you have built an incentive to close cases blind.<\/p>\n

What the AIOps for Security myths share<\/h2>\n

Look across all six and the common shape appears: each one substitutes a comfortable story for a measurement somebody could actually run. In one line each, the portable version:<\/p>\n