I have always believed that the skills people call talent are largely teachable. They develop through specific conditions and feedback. They are not assigned at birth in the way we often assume.
I am a proponent of AI and its potential across industries. I am also aware of what it is doing to roles and professions, and how it is commoditizing technical skills that were once the domain of the few.
That matters in cybersecurity because the industry is not only changing how work gets done. It is changing how future expertise gets formed. The short-term win is speed. The longer-term risk is a thinner bench of analysts who have not done enough real investigation to build judgment.
AI can make security operations faster and more efficient. But if organizations are not careful, it may also remove the very work that helps analysts develop judgment.
There is a body of research on the “smart intuitor,” where highly capable people generate accurate, logical solutions almost instantly, before conscious deliberation has time to complete. A study published in Cognition on cognitive ability and intuitive accuracy argues that stronger reasoners may have more accurate intuitions, rather than simply being better at correcting bad ones later.
This is not gut feeling in the mystical sense. It is pattern recognition, built from repeated exposure to hard problems and corrected by feedback.
The “smart intuitor” hypothesis suggests high cognitive ability may directly fuel more accurate initial instincts, rather than simply improving error correction through later deliberation. Related work on adolescent reasoning points in the same direction: this association appears to mature in late adolescence or adulthood. It forms slowly, through experience. It cannot be compressed into a training module.
I think about this constantly in the context of security operations, though the implications extend well beyond it.
How analyst intuition forms
Senior security analysts often make investigative leaps that are hard to explain afterward. They connect a financial anomaly to a network event to a physical access log and arrive at a hypothesis before they can fully articulate why.
What looks like instinct is often a pattern library built through thousands of cases, each one correcting the model a little. In this framework, intuition is not the opposite of logic. It is reasoning that has become fast enough to look instinctive.
The same pattern shows up in other expert fields. Experienced people often see the shape of a problem before they can explain every step that got them there.
Malcolm Gladwell popularized this idea as “thin-slicing” in Blink: The Power of Thinking Without Thinking: the unconscious mind pattern-matching against experience to arrive at a judgment faster than conscious reasoning can follow. His examples of firefighters, grandmasters and art experts are all running versions of the same process.
But the quality of the instinct depends on what built it. Rapid cognition fails when the pattern library is built on biased, shallow or incomplete exposure. Garbage in, garbage out applies to human expertise as directly as it does to any model.
This capacity is teachable, but it is time-dependent. The feedback loop requires volume: judge, observe, adjust. Over time, that cycle builds something that cannot be installed through documentation alone.
The work AI may remove
The security industry has already been removing some of these formation conditions.
MSSP outsourcing, MDR adoption and now AI-driven automation of Tier 1 analyst functions have all shifted high-volume, corrective-feedback work away from the junior analyst. Each shift was framed as an efficiency decision. Fewer organizations treated it as a formation decision.
AI has the technical capability to accelerate that trend.
That does not mean organizations should preserve busywork for its own sake. Much of Tier 1 security work has been repetitive, noisy and frustrating. Analysts should not spend their careers clearing low-value alerts.
But those early investigations also create the repetition that helps analysts learn what normal looks like, what suspicious looks like, and when a weak signal deserves more attention. When that experience disappears, the development pipeline changes.
The question is not only what AI can automate. It is what kind of judgment the organization still needs humans to develop.
What remains after automation
Some technologists have described artificial intuition as a later stage of machine intelligence, in which systems identify possibilities in unfamiliar scenarios without being told exactly what to look for.
Strategic decision-making is also moving toward what some researchers and business thinkers call co-intelligence: human judgment augmented by machine logic to navigate uncertainty.
These are not soft skills. AI optimizes around what is already known, observed or encoded. Human imagination is the capacity to reason about what is not yet defined.
The cognitive capacities that remain most valuable are critical thinking, intuition, creativity and imagination. These are not soft skills. They determine whether a human operator remains valuable when agents can handle well-defined tasks.
Researchers have described different forms of intuition, including holistic, inferential and affective intuition. In practice, intuition is the moment when accumulated experience starts doing work before the analyst can fully explain it.
An adversarial analyst anticipating an attack chain that has not yet been enumerated is using imagination. An AI system optimizing detection against known patterns is doing something different.
The concern is that these human capacities develop through the same conditions automation can remove: volume, corrective feedback, productive failure, cross-domain exposure and enough tolerance for ambiguity to let judgment form.
The analyst pipeline problem
The same problem shows up outside the SOC. A child reasoning through an open problem and an analyst investigating a threat are engaged in a similar process: there is no predetermined answer, hypotheses must be formed and tested, and being wrong is useful if the feedback is clear.
Educational systems that minimize failure and optimize only for measurable correct output work against this mechanism. The investigation model, where the goal is to develop accurate hypotheses under uncertainty, most closely mirrors how expertise forms.
Organizations face the same issue. The roles AI is most likely to affect first are often high-volume and lower-variance roles where junior analysts accumulate the corrective feedback that later supports senior judgment.
Automating those roles without creating replacement formation mechanisms may cut the pipeline rather than streamline it.
That means AI platforms should expose reasoning paths, not just outputs, so reviewing agent work becomes a judgment-building activity. It also means tracking analyst override rates as a proxy for engagement. An override rate of zero should not automatically be treated as a success metric. It may be a signal that analysts have stopped challenging the system.
A formation problem, not just an efficiency problem
If AI gets better at handling defined problems, people become more valuable when the problem itself is still unclear.
Organizations that want creative analysts later have to give junior analysts room to struggle now. Those that treat automation only as a cost-reduction exercise may discover the deficit later, when the next generation of experts is expected to exercise judgment it was never given a chance to build.
The alignment between intelligent first instinct and accurate outcome is not fixed at birth. It is built through iteration and breadth of exposure. This applies to a 12-year-old in a classroom and to a security analyst reviewing agent reasoning chains in a SOC. The lesson is the same in both cases: judgment gets stronger when people have enough chances to test it.
As organizations automate more security work, they should also design new ways for analysts to build intuition. The goal should not be to make analysts passive reviewers of machine output. It should be to make AI review a new form of analyst training.
Done well, AI could give analysts better ways to practice judgment, not fewer chances to develop it. Analysts can help shape the agents that work alongside them, encoding judgment back into the system and refocusing on what their role was supposed to be in the first place: defending the organization against novel attacks, not just reducing noise through log triage.
Image: Photo by Wes Hicks on Unsplash
