Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots
13:37 · July 13, 2026 · Hacker News AI Section
A few days ago, I was sitting with the CISO of a Fortune 50 company, walking through how his security team was thinking about AI agents in the SOC. Smart team. Serious program. They had already connected Claude to a few detection tools and were seeing real value in specific investigations. But as we mapped out the broader architecture, something kept nagging at me. The design they were building
Summary
The article draws on Daniel Kahneman’s distinction between two modes of cognition to argue for a dual-layer architecture in security operations centers. System 1 processing, fast, automatic, and pattern-driven, maps onto the bulk of alert triage. System 2 processing, slower and deliberative, is reserved for the minority of cases that require judgment under uncertainty. Data cited from more than 25 million enterprise alerts indicate that roughly 98 percent of signals can be resolved without human review, leaving about 2 percent that merit escalation, a distribution that closely parallels Kahneman’s estimate of 95 percent automatic versus 5 percent effortful human thought.
Current SOC designs often violate this separation. Analysts are asked to perform repetitive, high-volume triage—an activity that exhausts limited cognitive resources—while frontier models such as Claude are applied directly to raw detection streams. Both practices produce the same outcome: incomplete coverage of low-severity alerts that nevertheless contain real threats, and uneconomic consumption of expensive inference capacity. The piece notes that an organization generating 450,000 alerts annually can expect approximately 54 genuine incidents to remain buried in the unexamined tail.
An effective architecture therefore deploys an autonomous investigation layer that continuously examines every signal, performs memory scans, file analysis, and cross-domain correlation, then closes clear noise or assembles evidence for the remaining cases. Human analysts, supported by copilots, receive only these curated packages. Their work shifts from initial validation to synthesis, rule refinement, and context-aware response. Because every analyst decision is retained in a shared knowledge base, the autonomous layer improves over successive cycles without additional manual labeling.
The argument extends to sourcing decisions. Organizations that outsource investigation to managed detection and response providers lose ownership of the accumulated triage logic and organizational context. Retaining that layer in-house is presented as a prerequisite for making analyst copilots operationally useful rather than merely additive. In this configuration, the fast layer handles volume at machine speed while the slow layer applies scarce human attention where it yields the greatest marginal value.
Why it matters
This article provides a highly actionable framework for SOCs by applying Kahneman's System 1/System 2 thinking to AI deployment. It is highly relevant for Dutch security professionals looking to optimize alert triage, reduce analyst burnout, and effectively integrate autonomous AI and copilots without prohibitive costs.
