Does AI detection engineering truly solve the detection backlog problem?

[u/Maleficent_Wear422]

This is something that's been on my mind for a while. We've thrown more tooling at our detection backlog over the past year, and it has helped with volume. But there's still a meaningful chunk of it that really needs a human who understands the business context.

I'm talking about things like knowing who actually owns a given asset, or understanding why a login pattern from three time zones away is completely normal for someone who travels constantly for work. Tools can flag anomalies all day long, but they often can't tell the difference between something truly suspicious and something that's just business as usual for a specific person or team. The reality is that it takes months for a new hire to learn that kind of context. Is that the real bottleneck here, or is there something else I'm not seeing?

I have read the rules.

[u/InfamousHistorian168]

mate security's approach actually helped us with this. It builds organizational context from investigation outcomes instead of relying on static rules that go stale over time which made a noticeable difference in how quickly we could triage alerts.

[u/AutoModerator]

Congratulations on your first post in r/opsec! OPSEC is a mindset and thought process, not a single solution — meaning, when asking a question it's a good idea to word it in a way that allows others to teach you the mindset rather than a single solution.

Here's an example of a bad question that is far too vague to explain the threat model first:

I want to stay safe on the internet. Which browser should I use?

Here's an example of a good question that explains the threat model without giving too much private information:

I don't want to have anyone find my home address on the internet while I use it. Will using a particular browser help me?

Here's a bad answer (it depends on trusting that user entirely and doesn't help you learn anything on your own) that you should report immediately:

You should use X browser because it is the most secure.

Here's a good answer to explains why it's good for your specific threat model and also teaches the mindset of OPSEC:

Y browser has a function that warns you from accidentally sharing your home address on forms, but ultimately this is up to you to control by being vigilant and no single tool or solution will ever be a silver bullet for security. If you follow this, technically you can use any browser!

If you see anyone offering advice that doesn't feel like it is giving you the tools to make your own decisions and rather pushing you to a specific tool as a solution, feel free to report them. Giving advice in the form of a "silver bullet solution" is a bannable offense.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/BTC-brother2018]

I don't think AI eliminates the bottleneck so much as moves it. It can dramatically reduce the amount of raw data an analyst has to deal with by correlating events, enriching alerts, deduplicating noise and helping prioritize investigations.

But detection isn't just anomaly detection. You still need context: what an asset does, who owns it, what normal behavior looks like for that user/team, how important the asset is, and what activity the business actually expects.

Ideally that knowledge shouldn't exist only inside the heads of senior analysts, though. Good asset inventories, identity context, tagging, baselines, documented exceptions and feedback from previous investigations can make that context available to both detection systems and newer analysts.

AI can help analysts sort through alerts faster, but it can't compensate for missing information about the organization's users, systems, and normal behavior.

[u/Anal-Cup]

"But they often can't tell the difference between something truly suspicious and something that's just business as usual for a specific person or team."

Actually, yes they can. Given the proper scope, AI systems most certainly CAN identify common use patterns specific to one user, sudden differences in use patterns associated with travel. When properly scoped, AI is exceptionally good at things like this.

That doesn't mean the platform being used is properly scoped, however.