You still need all the typical blocking and tackling, policies, and processes in place. You just have to figure out how to do the things you already do more quickly.
Jason KinderSenior Director, Corporate Security - Cyber Security Operations, Leonardo DRSAI is putting security teams under growing pressure to detect intrusions and contain damage before attackers move further into their environments. Organizations are looking to automate investigations and response while preserving the human expertise needed to question automated findings, identify errors, and manage complex incidents.
Jason Kinder, Senior Director of Corporate Security – Cyber Security Operations at Leonardo DRS, brings more than two decades of experience managing IT infrastructure and cybersecurity in the defense industry. He oversees critical security infrastructure and leads incident response efforts, working across business functions to meet demanding Department of War compliance requirements. His experience offers a practical perspective on integrating AI into security operations.
“You still need all the typical blocking and tackling, policies, and processes in place. You just have to figure out how to do the things you already do more quickly,” Kinder says.
AI is shortening attack timelines and narrowing the window for defense
Kinder describes AI as a way for attackers to speed up activities they already perform, from discovering resources to identifying opportunities for data exfiltration. While human operators direct these activities, automation allows them to move through established attack sequences more efficiently. “It's taking an attack chain that might have taken a month from start to finish and condensing it into a shorter timeframe,” he explains.
The degree of acceleration varies with the target and attack complexity, leaving defenders with fewer opportunities to intervene as intrusion timelines shrink. Security teams need to identify vulnerabilities, apply patches, investigate suspicious activity, and respond to incidents.
The difference is how quickly they must complete those tasks. Improving response times requires reliable security processes alongside tools that reduce manual work. AI offers opportunities to accelerate established workflows, although “it takes orchestration, integration, and development to make that happen,” Kinder says.
Defensive AI requires more than a capable model
Generative AI has made experimentation easier, allowing teams to build proofs of concept in as little as 10 to 15 minutes. Integrating those capabilities into enterprise security operations is more challenging. “It's just a model. Somebody has to create the agents or the harness to integrate it into existing processes for it to provide any benefit,” he says. Teams must determine how AI connects with existing tools, accesses sensitive information, and supports investigations.
Kinder also observes that products designed to monitor usage and evaluate model responses may be suitable for commercial environments but lack certifications required for government or other regulated operations. Meanwhile, rapidly changing model capabilities and vendor offerings make it difficult for security teams to establish controls that remain suitable over time. “It's purely a catch-up game,” he says.
Analysts can't afford to take AI findings at face value
Even when AI meets an organization's security and compliance requirements, its conclusions still need scrutiny. “You have to question the output. Don't take everything at face value,” Kinder says. In security operations, misplaced confidence could lead analysts to overlook threats or pursue misleading findings.
AI-assisted triage could accelerate investigations by handling initial Tier 1 tasks, allowing analysts to review findings, investigate further, or escalate cases requiring advanced analysis. “If you're not 100% comfortable with the response, challenge it. Don't trust it,” Kinder says. Making those decisions requires analysts to understand the investigative process, recognize missing evidence, and question conclusions that don't match the available information.
Automation shouldn’t come at the expense of future security expertise
Kinder acknowledges that AI could eventually handle enough Tier 1 work for organizations to rely more heavily on Tier 2 and Tier 3 analysts. Yet those senior roles depend on skills typically developed through earlier investigations. “The only way to reach Tier 2 and Tier 3 is to go through the learning process and understand Tier 1 activities,” he explains.
As automation changes the structure of security teams, organizations should continue investing in training and practical experience. Faster investigations could free experienced analysts to focus on more complex threats, but sustaining those capabilities will depend on developing the next generation of analysts who can critically assess and challenge automated findings. “You might not build out Tier 1 the way you once did, but you must ensure that people moving into higher-level roles have those Tier 1 skills,” Kinder concludes.
