Usually no. Mixing them can hide whether the result came from human reasoning, agent orchestration, or a hybrid workflow. Separate tracks make it easier to judge true skill, measure automation limits, and decide where autonomous assistance is appropriate without degrading the educational or operational purpose of the exercise.
Why separate human and agent tracks usually produce better exercise data
Cybersecurity exercises are most useful when the evaluator can tell what actually drove the outcome. If humans and agents are scored in the same run, a strong result may reflect orchestration, retrieval quality, or tool permissions rather than human judgement. Separate tracks make the exercise easier to interpret, especially when you are trying to compare performance, not just see whether the team reached the right answer.
That distinction matters because agent behaviour is often shaped by access design, prompts, guardrails, and tool scope. If the exercise blends those variables together, you lose clarity about whether the control worked, whether the person made the right decision, or whether the system simply allowed the agent to execute quickly. AI Agents vs Agentic AI is useful background here because it shows how autonomy level changes the security and assessment model.
For organisations that are still calibrating agent use, a split design also helps prevent overclaiming capability. Human-only and agent-assisted exercise tracks let you compare judgment, speed, escalation behaviour, and error patterns without collapsing them into one score. That is especially important when the exercise is meant to teach, validate a process, or decide where autonomy is safe enough to expand.
What gets masked when you mix humans and agents
Mixed exercises can hide several different failure modes. A person may appear highly effective because the agent drafted the response, or an agent may appear reliable only because a human quietly corrected it midstream. In both cases, the exercise stops measuring a single capability and starts measuring an interaction pattern, which is harder to benchmark and easier to misread.
When the goal is governance as much as performance, the organisation should be able to distinguish human decision quality, agent execution quality, and the boundary between them. AI Agent Authorisation Guide is relevant because it frames agent action as something that should be scoped and decided explicitly, not assumed to be equivalent to human action.
That separation also helps when you are testing failure recovery. If the exercise includes escalation, containment, or manual override, you need to know whether the recovery happened because the human noticed the problem or because the agent happened to stop cleanly. Blended scoring can make weak human oversight look strong, or make a cautious agent look unhelpful when the real issue is poor orchestration.
How to design exercises that compare capability without distorting it
The most practical approach is to define the exercise objective first and then choose the track structure that matches it. If you want to test human judgement, keep the agent out of the scoring path. If you want to test agent operation, isolate the agent role and measure its output, permissions, and failure handling separately. If you want to test collaboration, make the hybrid workflow explicit and score the handoffs, not just the final result.
A useful control is to use the same scenario with different evaluation lenses. One run can assess human response alone, another can assess agent-assisted response, and a third can assess the combined workflow. That gives you comparable evidence without hiding the source of success or failure. AI Agent Observability, Audit and Incident Response Guide supports this approach because attribution and auditability are what make agent actions examinable in the first place.
Where organisations use agentic systems in real operations, the exercise should also reflect the same scope boundaries they expect in production. Zero Trust for AI Agents fits this need because it ties agent verification, request-level policy, and privilege reduction to observable control points. That makes it easier to test not only whether the exercise was completed, but whether the right kind of authority was used.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Exercises with agents must separate authority from human judgement. |
| Recommendation — Score agent access and human input separately to expose privilege-driven outcomes. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Exercise attribution depends on reviewable logs and decision traces. |
| CA-2 — Control Assessments | Cyber exercises are a form of assessment that should measure distinct capabilities. | |
| IA-9 — Identification and Authentication (Non-Organizational Users) | Agent participation requires explicit authentication and accountable identity boundaries. | |
| Recommendation — Review audit evidence to attribute outcomes to human or agent actions. Design assessments to isolate the capability being tested and avoid blended results. Authenticate agent participants distinctly from humans before exercising shared workflows. | ||
Practitioner Guidance
What to prioritise: Decide whether the exercise is meant to measure human judgement, agent performance, or the combined workflow before you write the scoring rubric. If that is not fixed up front, the results are too easy to overinterpret.
What to verify: Keep the evaluation evidence separate enough that you can explain who or what made each meaningful decision, especially when a tool call, recommendation, or escalation changed the outcome. If you cannot attribute the decisive step, the exercise result is too ambiguous to trust.
What practitioners underestimate: A hybrid exercise is not just a harder version of the same test, it is often a different test altogether. The moment an agent can act, the organisation is also testing orchestration, access scope, and handoff quality, whether or not those were the intended learning objectives.
Practitioner takeaway: Separate tracks are usually the better default because they preserve interpretability, expose real limits, and prevent autonomy from being mistaken for human skill.
Related resources from NHI Mgmt Group
- Should organisations treat agent access reviews the same as human access reviews?
- Should organisations use the same controls for agent outputs as for human code changes?
- When should organisations require human approval for an AI agent action?
- How can organisations prevent agent privilege drift across human and workload systems?