Securing the Human Layer: Balancing AI Automation and Human Oversight in Security Programs

In this session, we'll explore how to balance AI automation with human judgment when managing security incidents. Using relatable cloud security scenarios, we'll examine which decisions can be safely automated, when human intervention is necessary, and how to maintain accountability without slowing down incident response.

Transcript

1. Ogbomosho Securing the Human Layer Balancing AI Automation and Human Oversight in Security Programs
2. Ogbomosho Why am I qualified to give this talk? Mfonobong Umondia Devrel, Currently Contributing to the Open Source Security Foundation
3. Ogbomosho Hypothetically… let’s look at some timelines together.
4. Ogbomosho 9:05 AM | Suspicious login detected An employee's account signs in from an unfamiliar location using valid credentials and successfully completes multi-factor authentication (MFA). Minutes later, the account attempts to access sensitive customer records in Google Cloud Storage. 9:06 AM | AI assists with the investigation AI reviews relevant security logs, compares the activity with previous login patterns, connects related alerts, and prepares a summary highlighting why the behavior is suspicious.
5. Ogbomosho Now, imagine you're leading the company's security team. What would you do next?
6. 9:10 AM | Human judgment comes in A security analyst reviews the evidence, verifies whether the employee authorized the activity, and decides whether to revoke active sessions, restrict access, or escalate the incident. The team must contain any threat without unnecessarily disrupting legitimate business operations. Within 72 hours | Regulatory responsibility If the investigation establishes a personal data breach likely to put individuals' rights and freedoms at risk, the company must notify the Nigeria Data Protection Commission within 72 hours of becoming aware of that breach. Ogbomosho
7. Core lesson here An alert only protects you when a named engineer (human) acts on it.
8. Instead of treating every suspicious activity as a separate alert, an AI-assisted security tool like Google Security Operations (Google SecOps) can connect related security alerts, identify affected cloud resources and accounts, and use Gemini to summarize suspicious activity and recommend next steps. With the right integrations, it can also identify resource owners, helping security teams investigate and respond faster.
9. The security benefit is clear. With AI handling much of the initial alert analysis, security teams spend less time sorting through alerts and more time investigating potential threats. They can quickly verify suspicious activity, determine whether an account has been compromised, and take appropriate action, such as revoking compromised credentials to prevent further unauthorized access.
10. AI helps security teams detect and investigate threats faster, but human oversight remains essential to verify findings, assess risks, and make high-impact security decisions.
11. You may be wondering, when has AI crossed the security boundary?
12. In May 2026, someone gave an AI agent access to AWS to help map an experimental computer network. The agent could make decisions about what cloud infrastructure it needed. It went ahead with resource provisioning, and within approximately 24 hours, the operator reported an AWS bill of over $6,500.
13. Now, think about that for a moment. The agent wasn't trying to steal money. It was attempting to complete an assigned task. But it had access to cloud resources without sufficient restrictions on how much it could provision or spend.
14. Imagine that same level of autonomy inside a company's security operations, where an AI agent has permission to modify access policies, launch infrastructure, or take production systems offline.
15. The question is not whether AI can execute these actions. We already know it can. The question is whether we've put the right controls in place to stop it from making an expensive or dangerous decision. That's why human oversight must be built into the system before the AI takes action, not introduced only after something goes wrong. Ogbomosho
16. Plus… human oversight in security cannot and should not be limited to reviewing an incident after something goes wrong. We need; • • • • enforceable permissions, approval requirements for high-impact actions, continuous monitoring, and mechanisms to stop an agent before it causes damage.
17. The safest AI-assisted Security Operations Center is faster because its decisions are better controlled. Automate the repetitive work Use AI to correlate signals, enrich alerts, and prepare evidence. Keep judgment where consequences are significant. Engineer oversight into the workflow. Require meaningful review for uncertain, sensitive, or high-impact decisions. Define evidence, action limits, ownership, and recovery before deployment.
18. So here’s my key takeaway… • • • • Let AI handle the volume, so people can focus on the actual risk. Sort each workflow into Automate, Augment or Human-only. Give every automation a brake, a log and a named owner. Keep sensitive disclosures and high-stakes calls with people.
19. Q&A Can’t think of questions now? Ask me on X (formerly Twitter) @the_ladybella