Use AI to assist security analysis without confusing a generated explanation with evidence. Design the workflow around telemetry, validation and controlled actions.
Define one measurable analyst task
Begin with a bounded task such as summarising an authentication alert or collecting relevant investigation context. Specify which logs the analyst needs and the output that would save time. Compare against the existing process using representative cases, including false positives and incomplete records. Measure correctness, analyst review time and missed important facts, not just the speed of generated text.
Preserve the source behind every claim
Normalise timestamps, identify the originating system and retain event identifiers. A summary should link conclusions to the underlying records and state when evidence is missing. An unusual login is a reason to investigate, not proof of compromise. Test whether the model invents events or merges different users, and require an analyst to verify important conclusions before escalation.
Treat retrieved content as untrusted
Logs, emails and documents can contain text written by an attacker. Instructions inside that material must not control the assistant or authorise a tool. Separate system instructions from evidence and restrict retrieval to the case and the analyst’s permissions. Minimise sensitive data sent to a model; agree retention and provider processing arrangements before operational use.
Put controls around response actions
Start with read-only assistance. If tools are introduced, use scoped identities, explicit allowlists and an approval step for disruptive actions such as account suspension. Record the request, evidence, approval and result. Apply timeouts and retry limits, and define a manual fallback. A confident model answer must never substitute for authority to change a production system.
Evaluate before expanding coverage
Retain a test set containing normal activity, genuine incidents, ambiguous cases and adversarial content. Re-run it when prompts, models or data sources change. Review failure patterns with analysts and maintain an option to disable the assistant without losing core monitoring. TRUST-IT can help define a controlled pilot and its acceptance criteria; performance depends on the selected systems and available evidence.