- In cybersecurity, you need to know what to look for and where. Otherwise you're searching for a needle in a desert; unusual enough to be seen but unlikely to be found.
- Humans are like horses. Straight vision. Can see in only one direction at a time.
- Machines on the other hand, only look for what you tell them to. They can't decide on their own about what to look for. If they could, they'd replace humans. They can in fact replace a lot of human straight looking cases. Repetitive bureaucratic stuff should be replaced with more efficient processes that reduce the load to do the actual activity that brings out the most from an activity in an 80/20 sense. But those repetitive case handling scripts need to be written by humans.
- A lot of the times, cybersecurity is just looking and searching for common patterns using common methods, tools & processes. It's very standard to be repeatable but hard to be replicated by machines.
- What machines can't handle:
- The volume of data matters a lot: Like I said, the machine only looks for what it has been told to look for. The human can look for any sort of weirdness. If the human has convinced themselves that there’s something weird going on in a sample, they would work by listing all the possibilities and elimination of the improbable. While on the other hand, a machine would not look way beyond. Hell if you’re using an LLM, you’re one erronous instruction, context overflow or prompt injection away from a hallucination.
- Sometimes the Horse Vision becomes an important factor itself. Machines can’t & don’t ignore the noise but due to the virtue of this Horse Vision Humans do.
- The specific knowledge of the professional isn't on the internet & is only gained through experience. If specifically comparing it with a generalist LLM, most of it has been trained on generic datasets. It doesn’t have the specialized knowledge to understand things the way an expert would do. They simulate the thinking process but can’t simulate the best possible experience.