Two very different products get sold under names that sound alike, and buyers keep mixing them up. One kind watches servers, correlates infrastructure events and predicts disk failures. The other reads security signals: logins, inbox traffic, identity trails. The second kind has lately collected under the phrase AIOps for Security — an editorial label, young and thoroughly unstandardised, for the machine-learning and LLM assistance now spreading through defensive work. This piece is a plain-language tour of what belongs under that label, what stays outside it, and the handful of numbers that separate a trustworthy deployment from a well-produced demo.

What AIOps for Security covers, and what it leaves out

The honest scope has five rooms in it. Anomaly detection and user behaviour analytics, where models decide which account activity looks wrong. Alert scoring, where a ranker decides which of ten thousand queued events deserves a human’s eyes first. LLM-assisted investigation, where an agent drafts the timeline, pulls the related logs and suggests a verdict. Then two rooms most vendors skip in the brochure: evaluation — base rates, miss counts, false-action counts, drift checks, adversarial testing — and autonomy levels, which record how much of the decision the software may make alone. Deliberately outside: IT event correlation, rule-writing practice, containment playbooks, telemetry plumbing, vulnerability prioritisation and LLMOps. The security flavour earns its own label because its input is adversarial and adaptive — a patient opponent shapes the data — and because a single missed detection can cost breach-scale money.

One paragraph of base-rate arithmetic

Everything about these tools gets decided by arithmetic that predates them. The classic teaching example comes from Axelsson’s fraud-detection work in 2000: with truly bad items arriving at a rate of 2 in 100,000, a detector that wrongly flags one healthy item in 100,000 still produces a stream in which two of every three alerts are genuine — a predictive value near 66.7%. Loosen that error rate by two orders of magnitude, to one in a thousand, and the same detector’s predictive value collapses to roughly 1.4%. Nothing about the model changed. The population did. That is the whole disease of alert triage in one paragraph: rarity punishes imprecision with brutal efficiency, and no amount of tuning the user interface changes it. Any vendor chart that reports accuracy without stating the prevalence of attacks in the test set is reporting a number with no meaning attached. Insist on prevalence, and half the marketing material in this field quietly empties itself.

Why researchers spent years doubting the published scores

Security ML has a documented habit of looking better on paper than in production. Sommer and Paxson said it plainly in 2010:

Machine learning is “rarely employed” in operational settings, because the price of being wrong is simply too high.

Fifteen years on, the distrust has held up. A line of work called TESSERACT, published between 2019 and 2022, showed detector scores near a perfect 0.99 F1 collapsing once spatial and temporal bias were stripped out of the evaluation. A widely cited audit by Arp and colleagues worked through 30 top-tier security ML papers: nine in ten carried sampling bias, and 73% practised data snooping, where test-set information leaks backwards into training choices. When you next see a vendor slide with a near-perfect score, the correct reading is not “excellent model”. It is “unverified evaluation”.

What AIOps for Security agents actually score today

Independent benchmarks cut through brochure numbers, and the picture they paint is promising and humbling at once. ITBench, presented at ICML 2025, put autonomous agents through compliance-and-security scenarios: they resolved 25.2% end to end. CyberSOCEval — run jointly in 2025 by Meta and CrowdStrike — scored agents between 23% and 34% on malware-analysis work and between 43% and 53% on threat-intel reasoning; pure chance lands at 0.63% and 1.7% respectively. Read those correctly: the systems are clearly doing something real, and they are nowhere near ready to hand the whole desk to. Benchmarks differ from vendor trials in one crucial respect — somebody else chose the test set. A tool that resolves one scenario in four is a junior colleague with knowledge gaps, not an operator you leave unsupervised.

What a spotless error sheet is actually worth

Evaluation talks are full of phrases like “we found no misses”, and the arithmetic of small samples decides how much that proves. The old rule of three does the job: if a test runs n cases with zero failures, the true failure rate is probably no worse than about 3 divided by n. Twenty clean trials bound your risk near 15%. Two hundred near 1.5%. Flip it around and the sample sizes demanded by serious autonomy gates start to look modest: demonstrating a miss rate at or under 2% when one miss has already been observed takes 236 samples, and two observed misses take 313. A weekend pilot with a few dozen hand-picked alerts, however flattering its results, proves nothing of the kind. This is why the gates attach minimum counts — 150 or more true positives for auto-closure — instead of accepting a clean afternoon.

A short ladder for readers in a hurry

• Level 0. The system watches and scores. Nothing it concludes changes anything.
• Level 1. It recommends a verdict; a person stays the decision-maker. Evidence expected: 200-plus labelled alerts with at least 30 real positives.
• Level 2. It closes alerts with no person involved — earned only through a miss bound of 2% or better on 150-plus true positives, canary checks, a blind holdout and instant reopening.
• Level 3. It takes reversible actions such as suspending a session, held to a false-action bound near 1% over 300-plus eligible verdicts, with rollback tested and volume throttled.
• Level 4. Irreversible acts. Not granted to software, full stop.

Notice the pattern: every rung above level 1 is bought with measurement, not with promises. The rungs are also earned per action class — a product cleared to close phishing has purchased no authority over identity events. And the clock matters as much as the counts: models drift as attacker behaviour shifts, so a gate proved last quarter is a claim about last quarter’s world, not this one’s.

The takeaway for people who follow AI for a living

The label will keep spreading; the underlying discipline is what matters. Before your team adopts anything in this family, ask which rung the vendor claims, what the miss bound is, how many true positives back it, and whether those numbers were produced in a similar environment to yours — because vendor accuracy demonstrably does not travel between estates. Our pieces on how AI improves business decision making and why prediction systems guess the way they do cover the same trap from the analytics side: a model tuned to one population misbehaves on the next. And when a vendor’s claims need weighing side by side, the questions in our guide to comparing AI tools all apply — with one addition. Ask to see the evaluation, not the demo. The working reference for everything above sits in the Ops Atlas, under AIOps for Security, and it is the rare page in this field that spends more space on how to be wrong than on how to sound impressive.