job, but someone who uses AI better might. Work is evolving towards the more nuanced, complex and collaborative, including industry-wide threat collaboration and societal-level defence. We addressed this head-on with a dedicated ‘People Workstream’ covering governance, assurance, job description updates and time reallocation planning. But comfort was not only a people problem; it was an engineering one too. I had to be personally confident the agents were safe, auditable and properly controlled before they could make decisions in live workflows. That meant multi-layered controls: authentication – especially for agent Application Programming Interfaces (APIs); identity management for interagent and agent-to-tool communication; governance of secrets and tokens; content filtering to mitigate prompt injection and jailbreaks; and defence-in-depth authorisation backed by role-based access controls. We added independent verification and validation: deterministic pre-checks before any AI-driven decision; confidence scoring on machinegenerated detections; conservative downgrade logic; and purple-teaming (bringing together offensive and defensive cyber teams) to test that the controls held against real threat behaviours. For high-risk actions, such as callout recommendations, we required documented rationale, parallel running with humans and shift-handover summaries of agent decisions. Trust was earned gradually. PROVING THE VALUE AI enablement needs to deliver a measurable return. We kept our traditional SOC metrics – triage time, mean time to respond, false-positive rates – and added agent-specific ones: detection coverage gaps closed, intelligence-to-action time, manual hours saved, and unnecessary callouts avoided, when the system correctly decided not to wake a human for a false positive. We also track employee engagement and workload, because reducing burnout was the whole point. Costs such as prompt usage, tooling, and engineering time are tracked against those gains so we can see return on investment holistically rather than as a vanity metric. WHAT COMES NEXT It may seem we have come a long way, but we are still early in the journey. Agent-to-agent interactions, longterm role evolution and the parallel development of adversarial agents by threat actors all remain open questions. Regulatory assurance requirements in critical national infrastructure demand continued caution. We will need new layers of purpleteaming for an AI-versus-AI world, continuous career path redesign so that people are not deskilled, and mature cost governance so savings are reinvested in strategy rather than absorbed as headcount cuts. I suspect the principles will stay constant. You will start with a problem, build the foundation, treat your agents as team-mates you remain accountable for, and care for your people first. This is my ithihaasa, the Sanskrit term for ‘that is how it happened’. Every journey will be different, but I hope this equips other leaders with practical guidance and a sense of what the journey truly entails, and helps them navigate the path with greater clarity, confidence, and humanity. FIFTY FOUR DEGREES | 37 Reena Pathak works in cyber defence, and is also a Cyber Leader in Residence at Lancaster University. The opinions expressed in this piece are the author’s own and do not reflect the views, policies or practices of any current or former employer. All examples, metrics and technical details have been generalised and anonymised.
RkJQdWJsaXNoZXIy NTI5NzM=