Cyber Strategy
Human in the Lead: Rewriting Cybersecurity for the Age of Machine-on-Machine Conflict
QUICK SUMMARY
As AI transforms cybersecurity, technology alone is no longer the differentiator. Human judgment, governance, and strategic leadership are. This article explores why organizations must move beyond “human in the loop” to embrace a “human in the lead” approach that keeps people accountable for defining mission, risk, and resilience.
In cybersecurity, we have spent the last decade obsessed with tools. Shodan, Cobalt Strike, Nessus, and a growing alphabet soup of platforms define many security budgets and board conversations. But listening to our Cybersecurity Strategy Panel this past Spring, one thing became clear: the defining question of the AI era is not which tools we use, but who is truly in charge of them.
In an age of machine-on-machine conflict, “human in the loop” is no longer enough. We need a new paradigm: human in the lead.
Beyond Tools: Our Only Real Asymmetric Advantage
AI powered tools are now cheap, scalable, and widely available. The same platforms that help defenders can be repurposed by attackers. The panel highlighted that these tools are not the differentiator, they are the baseline.
What remains uniquely ours is human insight:
- The nuanced understanding of our own organizations
- The ability to weigh tradeoffs across risk, regulation, and opportunity
- The capacity to interpret not just data, but context, intent, and consequence
Technology can scan a network at speed. Only humans can decide which business processes truly matter, which risks are existential, and which controls are culturally and operationally sustainable. That human judgment is the only advantage attackers cannot easily copy or scale.
This is the first pillar of “human in the lead”: we design the mission, define the boundaries, and interpret the stakes.
Machines execute; humans decide why it matters.
Regulation as a Security Surface
Our adversaries operate seamlessly across borders. Our regulations, however, do not.
From a regulatory lens, the panel underscored how fragmented national rules are creating a new kind of vulnerability. Governments are beginning to recognize this and launch efforts, from the OECD to G7 linked initiatives, to bring some coherence to expectations around data, intelligence, and cybersecurity.
But while these processes play out, companies are living the reality of:
- Different compliance regimes in each country
- Conflicting expectations around data localization and sharing
- Friction in building unified security architectures across markets
“Human in the lead” means boards and executives cannot treat regulation as a passive backdrop. Regulators are explicitly asking: What harms are you experiencing today? What benefits could you realize under a more unified model?
Leaders have a narrow window to inject business and security specific insight into policy debates. Doing so is not lobbying for convenience; it is shaping the conditions for effective defense at scale.
The Schumer Scenario and the End of Signature Only Thinking
The audience question referencing a recent Matt Schumer piece put words to an anxiety many in the room shared: we are entering an era where the next generation of AI is being built by the previous one.
In this world, classic signature based defenses are increasingly inadequate. Offense will be:
- Learning, adapting, and mutating at machine speed
- Capable of generating novel attack paths and payloads
- Operating continuously, not episodically
Defenders must shift from reactive pattern matching to anticipatory, intelligence driven security. This is where “human in the lead” becomes critical:
- AI can surface anomalies; humans must prioritize what truly matters.
- AI can propose responses; humans must define the playbook, escalation thresholds, and rules of engagement.
- AI can simulate outcomes; humans must decide which risks are tolerable and which are not.
The threat is evolving faster, but so can our strategy, if we resist the temptation to simply “throw more AI at it” and instead put human strategy ahead of machine capability.
From Human in the Loop to Human in the Lead
Much has been made of “human in the loop” and “human on the loop” in AI governance. These constructs matter, but they are operational descriptions, not leadership philosophies.
“Human in the lead” reframes the relationship:
- Human in the loop: The person approves or overrides specific machine decisions.
- Human on the loop: The person supervises systems and intervenes at higher levels.
- Human in the lead: The person authors the mission, sets the rules of engagement, defines acceptable risk, and designs how and where machines are allowed to act.
In practice, that means:
- Strategic Intent – Humans define outcomes, not just thresholds. What are we trying to protect, and why?
- Rules of Engagement – Borrowing from military practice, leaders define when autonomous systems may act, when escalation is mandatory, and which actions are categorically off limits.
- Governance Architecture – Instead of sprinkling “human approvals” across workflows, organizations design layered oversight: tactical (analyst), operational (CISO and risk leaders), and strategic (board).
- Ethics and Accountability – When something goes wrong, accountability must land with humans, not models. “The AI did it” is not a governance strategy.
Machines can, and should, make many decisions at speed. But they should do so within a human authored framework, aligned to human values, business strategy, and legal obligations.
Planning for Recovery, Not Just Mitigation
Another powerful shift raised in the panel was the move from pure risk mitigation toward recovery and resilience. As AI systems and autonomous agents grow more complex, we must assume that:
- Some will behave in unexpected ways
- Some will be compromised or misused
- Some will generate emergent behaviors we only partially understand
“Human in the lead” means we are not just trying to prevent all failures; we are designing for graceful failure:
- Clear incident response playbooks for AI driven systems
- Containment strategies when autonomous agents go off course
- Transparent criteria for when to roll back or shut down capabilities
This mindset turns fear of AI driven incidents into preparation for AI era resilience.
A New Brief for Boards
Finally, the board’s role is changing from passive oversight to active shaper of the AI, cyber, and regulation nexus. Boards should be asking:
- What does today’s fragmented regulatory landscape really cost us, in security, agility, and market access?
- Where are we explicitly choosing to entrust autonomy to machines, and under what rules?
- How are we ensuring that human judgment, at board and executive level, remains in the lead, not sleepwalking behind “black box” decisions?
Boards are uniquely positioned to connect economic incentives, risk appetite, regulatory exposure, and societal expectations. That perspective is exactly what governments are now soliciting, and what internal teams need to build coherent strategies.
The age of AI driven machine on machine cybersecurity is here. The question is not whether humans will be in the loop; they already are, somewhere.
The real question is whether humans are in the lead: authoring the mission, setting the guardrails, and taking responsibility for the world these systems are helping us build.
“Human in the lead” is not a slogan. It is the only sustainable operating model for cybersecurity, and for governance, at global scale.
Are you ready to take the next step in your cybersecurity journey?
The Cyber Guild connects leaders, practitioners, and emerging talent through events, mentorship, and community.
👉 Explore upcoming events
👉 Subscribe to our mailing list
👉 Learn more about RISE Mentorship
ABOUT THE AUTHOR
Tiziana Barrow is the founder of SaferShift and a 30-year cybersecurity veteran who believes the biggest gap in digital safety isn't technology. It's narrative. She writes about turning human risk from a compliance checkbox into a cultural habit.