AI is accelerating the pace of cybersecurity on both sides. Attackers can find and act on information at machine speed, shortening the time required to detect and defend against cyberattacks. AI-powered detection and response solutions identify and rate potential threats at a similar pace. However, these defense solutions still require human oversight to verify remediation plans, select one, and respond to threats. Human judgment is especially important when decisions are consequential. So, how do you accelerate to outpace machine-speed attacks, but slow down just enough to uphold decision-quality and accountability?
From faster detection to better response
Optimizing human workflows to verify alerts and assess remediation options has a material impact on an organization’s mean time to respond (MTTR). Reducing decision/response times can be accomplished within a three-part framework:
- Understanding where decision time gets lost
- Rethinking human processes to complement AI speed
- Bringing CIO and CISO decision-making closer together
1. Understanding where decision time gets lost
Once an AI-powered solution identifies a threat, the slowdowns rarely come from the technology. They build up between teams, especially between security and network operations.
Consider a familiar scenario. The security team detects attackers probing an outdated VPN device and blocks the addresses they’re coming from. The attack stops. But the real fix, updating or replacing the device, belongs to the network team, which has its own priorities and schedule for changes. The ticket waits in their queue. Meanwhile, the security playbook says if it happens again, block the addresses again. The organization has stopped the attack, but the weakness they were targeting is still there.
The pattern has a familiar shape. At the security conferences I’ve attended this year, nearly every booth featured some version of the same diagram: a loop of detect, respond, learn, repeat. It’s meant to represent continuous improvement, and the loop itself is not the problem. The lack of progression beyond temporary containment is. Each cycle ends where the last one began, with the same team taking the same steps. When security and infrastructure decisions move through separate workflows, teams keep circling back to the same response instead of moving forward to fix the root cause.
That loop used to be survivable. Attackers ignored most old vulnerabilities because matching them to organizations that never patched them took too much manual work for uncertain payoffs. But AI makes that work fast and cheap enough to be worth doing at scale. An outdated device sitting in another team’s queue is now exactly what attackers go looking for.
Prioritization suffers, too. Whether a threat is live in your environment depends on network and configuration context that security teams often don’t own. Without it, alerts look equally urgent, and the ones that matter wait in line.
To find where this is happening, pull your last few incidents and map every step from detection to resolution. Note each time the work changed hands, how long it waited, and why. Pay closest attention to delays that had nothing to do with technology: approvals, tickets sitting in another team’s queue, questions about who owned the fix. Those are the constraints to target first.
2. Rethinking human processes to complement AI speed
Security and IT leaders think in terms of people, process, and technology. Unfortunately, most of the attention goes to people and technology, and process gets treated as an afterthought. With AI, process has to come first because most security processes were built for work that moved at human speed.
There are two ways to start rebuilding processes for AI speed.
- Work backward from governance, compliance, and business requirements. Start with what you’re obligated to deliver, then trace the decisions it demands. For example, a U.S. public company that experiences a material cybersecurity incident must disclose it within four business days of deeming it material. Working backward from that deadline raises concrete questions: Who makes the materiality call? What information do they need, and from which teams? How quickly can they get it?
- Work forward from the tasks AI is already changing. Look at the work AI is replacing or accelerating and ask whether the processes around it still fit the way the work gets done. Take alert triage, for example. AI can now sort and prioritize alerts and recommend a response, such as isolating a compromised laptop. But in many organizations, the process around that recommendation hasn’t changed. As AI compresses analysis from hours to seconds, the bottleneck shifts elsewhere. The organizations that benefit most will be those that redesign their operating models around faster, more informed decision-making.
3. Bringing CIO and CISO decision-making closer together
Some of the biggest gains at decision time come from narrowing the gap between security and infrastructure to obtain the context and visibility needed to make an informed decision. The CISO knows what needs to be done. The CIO knows what it will affect. Security may know the outdated VPN device needs to be replaced, but what else depends on it? What breaks if it goes offline for an afternoon?
The answer is to give network and security teams access to the same information at the same time, so security risk and infrastructure implications are considered together.
That also means rethinking what counts as noise. A traffic spike that the network team logs as a performance issue may be the first sign of an attack. A pattern that security dismisses may explain an outage the network team is chasing. Collected once and shared, the same data serves both.
Measure the time between knowing and acting
The mean time to detect will always matter. But in the AI era, the most important metric is the time between knowing and acting, and its effect on your MTTR. AI can reduce detection and remediation planning time by giving teams a continuously updated understanding of risk they’ve never had sight of before, but those gains depend on an organization’s ability to act on that information efficiently.
Chris serves as GTT’s Vice President of Strategy and Technology Adoption, accelerating the company to provide greater technology to advance its networking and security as a service solutions on the GTT Envision platform. Before joining GTT, Chris led technology platform sales at Accenture, focusing on communication and aerospace defense clients. As CEO of Total Marketing Concepts, he successfully transformed a large U.S. business process outsourcing (BPO) center from a premise-based operation to a fully cloud-based model with global reach. Most recently, he spearheaded the specialized SD-WAN/SASE/SSE and cybersecurity sales teams at Lumen Technologies. Through strategic innovation and collaboration, GTT delivers Greater Technology Together to help organizations navigate complex networking and security challenges.
