Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots

This contributed article argues that modern AI-enabled SOCs should mirror Kahneman’s System 1 (an autonomous, high-throughput forensic layer that resolves the vast majority of alerts) and System 2 (a human-supervised AI co-pilot for complex, deliberative investigations). The author warns against forcing human analysts to perform repetitive triage or deploying large LLMs directly against raw alerts, as both approaches waste cognitive and economic resources and risk missing low-severity threats and losing institutional knowledge when investigations are outsourced.