Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots

A recent article on The Hacker News draws a compelling parallel between Daniel Kahneman’s ‘Thinking, Fast and Slow’ and modern Security Operations Center (SOC) design. The author, Lital Asher-Dotan, CMO at Intezer, argues that many SOCs are misapplying AI by forcing human analysts or general-purpose language models to handle the bulk of alert triage—work that should be automated. Kahneman’s model posits that human cognition consists of System 1 (fast, automatic, 95% of thinking) and System 2 (slow, deliberate, 5%). The article contends that SOC alert data mirrors this: research on over 25 million alerts shows 98% can be resolved autonomously, with only 2% requiring human review.

The proposed solution is a dual-brain SOC architecture. The ‘fast brain’ is an autonomous AI that continuously investigates 100% of signals—memory scans, file analysis, cross-signal correlation—producing verdicts in under two minutes with 98% accuracy. This handles the 98% of alerts that are noise or routine. The ‘slow brain’ uses AI copilots like Claude, Codex, or Cursor for the 2% of complex cases requiring synthesis, judgment, and business context. These copilots receive fully assembled investigations, allowing analysts to supervise rather than triage.

The article identifies two failure modes: keeping human analysts in System 1 roles (manual triage leading to burnout and missed threats) and deploying frontier AI directly against raw alerts (expensive, still requires human initiation, and skips low-priority alerts). It also warns that outsourcing to MDR providers means losing the knowledge layer that accumulates from investigations, which is essential for making copilots effective. The key insight is that the two systems compound: every judgment from the slow brain feeds back to improve the fast brain’s accuracy.