AI in cybersecurity will augment jobs before it replaces them

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Prophet's blog post: AI will change how cybersecurity work is done by automating routine tasks, but it is unlikely to replace security professionals outright.

Why it matters: For IAM, NHI and security teams, the practical issue is how to rebalance human oversight, machine assistance and accountability as AI takes on more triage and analysis.

By the numbers:

• According to a Fortinet study cited by Prophet, 70% of organizations say the skills shortage and unfilled jobs increase security risks.

Context

AI in cybersecurity is less a replacement story than a control and operating-model story. The article describes AI as useful for speeding up routine security work, but not as a substitute for judgment in complex or adversarial situations. That distinction matters because security teams are not only automating tasks, they are deciding where human accountability still has to sit.

The identity angle is indirect but real. As security operations become more machine-assisted, teams have to govern who or what is authorised to act, when escalation is required, and how decisions are reviewed. That includes human analysts, AI systems, and any emerging agentic workflows that can trigger security actions with limited supervision.

The article’s starting position is typical of current enterprise reality: AI can compress work, but it does not erase the need for expertise, oversight or explainability.

Key questions

Q: How can teams use AI without weakening security accountability?

A: Teams can use AI to make cloud and identity data easier to query, but they should keep ownership of interpretation, escalation, and remediation with named security leads. AI should reduce the time it takes to find evidence, not blur who decides what that evidence means. That distinction preserves accountability while improving operational speed.

Q: Why does AI-driven application security still need tight governance and human oversight?

A: AI can accelerate discovery, detection, and remediation, but it also broadens the attack surface if it is deployed without governance. When developers use AI tools outside approved workflows, organisations can lose visibility into code movement, data exposure, and security decisions. The risk is not AI itself, but uncontrolled use that bypasses established policy, review, and accountability controls.

Q: What do security teams get wrong about AI-driven alert triage?

A: They often focus on speed and ignore governance. Faster triage is useful only if the reasoning is explainable, the evidence is retained, and analysts can override the result. Without those controls, AI simply accelerates both good decisions and bad ones.

Q: Should organisations prioritise automation or more analysts for AI-driven threats?

A: Automation should come first because the problem is speed and scale. More analysts may improve judgment, but they do not change the fact that attackers can generate more events than people can review. Organisations need software to absorb routine validation, triage, and containment so analysts can focus on high-confidence exceptions.

Technical breakdown

Why LLMs speed up security work but do not replace judgment

Large language models can accelerate pattern recognition, summarisation, enrichment and draft response generation because they are good at ingesting large volumes of text and correlating likely answers quickly. In cybersecurity, that is valuable for noisy tasks such as alert triage, questionnaire completion and initial code review. But speed is not the same as assurance. Security decisions often depend on context, intent, regulated evidence and adversarial thinking, which means the model can assist the workflow without owning the decision.

Practical implication: Use LLMs to reduce analyst load, but keep human approval on decisions that change access, containment or compliance posture.

Where AI-assisted security operations still need human control

Security operations tools can use AI to enrich alerts, cluster incidents and recommend next steps, but the control boundary remains important. If an automated system can infer a likely incident from partial signals, it still may not know whether the alert is business-critical, whether the evidence is complete, or whether the recommended action is safe in that environment. In practice, the more a tool can act, the more you need policy, logging and escalation rules around it.

Practical implication: Define which response actions are advisory, which are auto-executed and which require human sign-off before deployment.

Why explainability matters in regulated security workflows

The article’s concern about black-box AI reflects a broader governance issue. Security teams need to justify why a threat was classified a certain way, why a control was bypassed, or why a response was initiated. That is especially true where security operations feed audit, legal, or incident reporting processes. When AI is used in these workflows, model output becomes part of the evidence chain, so traceability and reviewability matter as much as accuracy.

Practical implication: Require audit trails for AI-supported security decisions and preserve the evidence needed to explain outcomes later.

NHI Mgmt Group analysis

AI will reshape security work by moving effort from repetition to judgment. The article is right to frame AI as an augmentation layer because many cybersecurity tasks are text-heavy, repetitive and pattern-based. That creates room for automation in triage, questionnaire handling and first-pass analysis, but it does not remove the need for contextual decision-making. Practitioners should expect role redesign, not role removal.

The governance problem is not whether AI can act, but where accountability sits when it does. Once AI starts recommending or triggering security actions, the team needs clear decision rights, review points and exception handling. That is especially important in environments where identity, access and incident decisions have business consequences. The practitioner conclusion is simple: automate tasks, not responsibility.

Explainability is becoming a security control, not a nice-to-have feature. The article correctly notes that regulated environments need defensible decisions, and that requirement extends to AI-assisted operations. If a model helps classify, prioritise or respond, the organisation must be able to explain the basis for that output. That makes evidence retention and decision traceability part of operational security, not just model governance.

AI creates a new security labour model, and that changes the skill mix. Human analysts will spend less time on rote enrichment and more time on review, tuning and escalation design. That makes AI literacy, adversarial awareness and workflow governance core competencies for modern security teams. The practitioner takeaway is to train for oversight capability, not just tool usage.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

AI-assisted security will shift the bottleneck from throughput to governance. The immediate question is no longer whether a tool can process alerts faster, but whether the organisation can explain and control the decisions it makes on behalf of analysts. That is why workflow design, approval boundaries and evidence retention should be treated as operational controls, not implementation details.

AI augments security work most effectively when the human role becomes more precise. Teams that leave analyst responsibilities vague will simply automate confusion, while teams that define review, escalation and exception handling can turn AI into a force multiplier. For identity-heavy environments, that precision becomes even more important when AI influences access, response or trust decisions.

For practitioners

• Define AI decision boundaries Specify which security tasks AI may only recommend, which it may execute automatically, and which always require analyst approval.
• Preserve evidence for AI-assisted decisions Keep alert context, model output and reviewer actions so teams can explain why a security decision was made after the fact.
• Rework analyst roles around oversight Shift human effort toward validation, exception handling, escalation design and adversarial review rather than repetitive enrichment.
• Add AI literacy to security training Train practitioners to understand model limits, false confidence, hallucination risk and when AI output should not be trusted.
• Map AI use cases to accountable owners Assign a named owner for every AI-supported workflow so response quality, governance and escalation are clearly controlled.

Key takeaways

• AI in cybersecurity is best understood as a labour-shaping technology, not a wholesale replacement for security staff.
• The practical risk is over-automating decisions that still need context, accountability and auditability.
• Teams that define human approval points and preserve evidence will get more value from AI without losing control.

Key terms

• AI-Assisted Triage: The use of machine-driven prioritisation to sort, rank or route suspicious cases for human review. It can improve speed and consistency, but only if analysts can understand, challenge and override the recommendation. Without governance, it becomes a hidden decision layer inside the investigation process.
• Human-in-the-Loop Decisioning: A control pattern in which AI assists with analysis or prioritisation but humans retain final authority over material outcomes. The point is not to add a reviewer at the end, but to preserve accountable human judgement where decisions affect pay, access, or trust.
• Decision Explainability: Decision explainability is the ability to understand why a system reached a specific outcome. In fraud and identity workflows, it means the organisation can trace the signals, confidence, and decision path well enough to review false positives, tune policy, and defend the result internally and externally.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management for practitioners who need clearer control over automated systems. It helps security and identity teams build the oversight skills that AI-assisted environments now demand.