For the better part of a decade, the dominant challenge in security operations was visibility. Logs weren’t centralised, telemetry was fragmented, blind spots were everywhere. 

But even where visibility has matured, a harder problem has emerged alongside it. Organisations that have invested seriously in SIEM maturity can now see more than they can interpret. Breaches keep happening, response times remain slow, analysts remain overwhelmed not because detection is failing, but because the bottleneck has shifted.  

It now sits in the gap between receiving an alert and reaching a confident conclusion about what it means and what to do next. 

Making decisions under pressure has always been the hardest part of security operations and AI has changed the tempo. AI is compressing attacker timelines faster than most organisations have adjusted for and slow decision-making can be dangerous. 

The CrowdStrike 2026 Global Threat Report puts a number on it: an average AI-enabled attacker breakout time of 29 minutes, with the fastest recorded instance at 27 seconds, and an 89% year-on-year increase in AI-enabled attacks. An attacker moving in under a minute isn’t waiting for an analyst to finish pivoting through four data sources. The advantage goes to whoever reaches clarity first. 

The metric we should have been tracking 

Mean time to detect has been the headline SOC metric for years. But it only measures when you first saw the signal, not when you understood what you were dealing with. 

An analyst can receive an alert within seconds and still spend the better part of an hour pivoting across endpoint telemetry, identity data, network logs, threat intelligence feeds, and historical case records before they have enough context to act.  

How quickly an analyst receives an alert is well tracked. How long it takes them to reach a confident conclusion is not. We call this gap time-to-understand and it’s what AI, when applied correctly, is beginning to close. 

The Decision Velocity Model 

AI is fundamentally altering the dynamic between detection and comprehension but acceleration without judgement introduces its own risk. Moving faster is only valuable if the decisions being made faster are the right ones. 

This is the tension security leaders need to actively manage, and it’s why at RiverSafe we developed the Decision Velocity Model: a practical framework for calibrating how much autonomy AI should hold at each point in the response chain, weighed against the operational risk of getting it wrong. 

Not every decision carries the same consequence. Triaging a low-confidence alert is different from isolating a production system. Enriching context is different from triggering containment. The model maps these distinctions explicitly, which decisions benefit from AI acceleration, which require human approval before action, and which should remain with a human regardless of how confident the AI output appears. 

You can view more here:  

The visibility problem is largely behind most mature SOCs. The decision velocity problem, how fast your team can move from signal to confident action, and how well your AI governance keeps pace with your adversaries, is where the next progress will be made.