Security operations has grown its own branch of machine-assisted tooling, and the branch has a name that confuses almost everyone the first time they hear it: AIOps for Security. This primer gives newcomers the minimum working knowledge — what the term covers, how it differs from the IT-operations AIOps you may already run, and a pocket glossary of the vocabulary used in every serious evaluation. Definitions here follow the working glossary published at this working glossary of AIOps for Security in the Ops Atlas, which is the best starting reference we know.
A short primer on AIOps for Security
The label is editorial, not official: no standards body ratified it and no founding paper exists. In practice it names the use of machine learning and large language models inside security work — anomaly detection, alert ranking, and investigation support — together with the evaluation discipline that decides how much those systems may be trusted. Two boundary notes matter. First, it is not a synonym for IT AIOps, which correlates infrastructure events; the security variant faces an adaptive adversary and pays breach-scale prices for mistakes. Second, the label excludes its neighbours: containment playbooks, detection engineering, telemetry pipelines, and vulnerability prioritisation all belong to other names. If a product card claims everything at once, read carefully. The working scope, in list form:
- In: anomaly detection and behaviour analytics, alert ranking, LLM-assisted investigation, agent evaluation, autonomy governance.
- Out: IT event correlation, rule-based detection work, SOC staffing, telemetry plumbing, containment, LLMOps, vulnerability triage.
- Fuzzy: anything a vendor defines to suit its pitch — ask which of the above a product actually does.
Why AIOps for Security needs its own vocabulary
Because its central question — how much may a machine be trusted to do alone? — has precise answers that only make sense with precise words. The glossary below collects the terms that appear in every procurement conversation worth having. Learn these ten and you can read an evidence file, audit a vendor claim, or brief a board without translation.
UEBA
User and entity behaviour analytics: profiling what accounts, hosts, and applications normally do, then scoring departures from that norm. Analysts have tracked it as a category of its own since roughly 2015. Its central weakness is semantic: an anomaly is a change, not an accusation — most turn out to be deployments, configuration edits, or new starters. Treating every deviation as hostile guarantees the pager gets ignored; treating none as hostile guarantees the intruder gets a quiet week.
Alert scoring
Ordering the queue so that likely-real items surface first. Well-built scoring attacks the exhaustion problem — the same exhaustion described in our alert-fatigue field notes from the IT side — by making each analyst-hour buy more true threats read. Its cardinal sin is letting the ranker choose which alerts receive labels, since a ranker that shapes its own training data grades its own homework.
Autonomy levels
The five-step scale attached to each class of action separately: L0 watch, L1 advise, L2 close tickets unaided, L3 take reversible actions, L4 — never granted. Promotion is earned with evidence. L1 requires a graded trial spanning at least 200 labelled alerts that contain 30 or more genuine hits. L2 requires misses at or under 2% across 150 true positives, canaries on patrol, a sealed holdout, and one-click reopen. L3 requires wrong moves under 1% across 300-plus cases where the system would have acted, rollback actually rehearsed, and hard volume limits.
Base rate
How often true positives actually occur, which controls whether precision is even possible. A stream of fifty million daily events holding fifty genuine threats contains one hostile item per million. At a misfire pace of one per ten thousand clean items, alerts land at 0.9% precision — about 112 readings per genuine catch. Tighten to one false alarm in a million and precision reaches 47.4%. This is why “our model is 95% accurate” means nothing without the base rate beside it.
Precision (PPV)
The share of alarms that are real. Axelsson’s intrusion-detection arithmetic from 2000 remains the cleanest illustration: with attacks at a rate of 0.00002, false alarms at 0.00001 leave two in three alarms genuine — 66.7% — while relaxing false alarms to 0.001 drops the genuine share to roughly 1.4%. Small changes in the false-alarm rate swing precision wildly when positives are rare.
Rule of three
With nothing wrong observed across n trials, the honest upper estimate of the error rate is about 3 divided by n. The corollary matters for contracts: one observed miss lifts the sample needed to claim a 2% ceiling to 236 cases; a second miss lifts it to 313. Small clean pilots prove remarkably little, which is why proof-of-concept deployments that report flawless weeks should trigger curiosity rather than celebration — the sample was too short to contain the interesting failures.
Canary
A seeded record planted in the queue to test whether a closing agent handles items it has never seen. A common dose runs fifty per quarter under a withdrawal clause: three canaries closed by the machine and the auto-close privilege ends. Canaries deliberately sample the dangerous region, which random audits of past closures — even flawless ones — do not.
Blind holdout
A labelled set withheld from the model entirely, graded only after testing. Blindness is the point: any data the model has seen, influenced, or helped select is compromised as a measuring stick, often through subtle sampling or snooping bias documented across the security ML literature.
Drift
The slow decay of any deployed model’s judgement as attackers, infrastructure, and human behaviour change around it. Drift is why evaluations expire and why mature programmes re-score monthly, per category, rather than certifying a model once and moving on. A gate earned in spring says little about autumn; the register of autonomy levels should carry expiry dates, and re-testing after major platform changes is not optional courtesy but basic hygiene.
Prompt injection
Attacker text that hijacks a model’s instructions. The UK’s NCSC argued in 2025 that treating it like SQL injection misleads: an LLM is better described as a deputy who can be talked into anything, with no guaranteed cure on the horizon. Deny-lists lose to unlimited rephrasing, so the workable defence pairs deterministic controls with least-privilege access for anything the model can touch.
AI washing
Gartner’s label for inflated capability claims — products dressed in AI vocabulary without the substance, or honest lab numbers quoted as transferable guarantees. Since every tenant’s base rates and noise are its own, the only accuracy that counts is measured locally, per category, on labelled traffic.
Where does a beginner practise? Start with the reading, then shadow: export dispositions, label a holdout, score one model, publish per-category numbers monthly, and keep autonomy at L0 until the file says otherwise. None of the ten terms above needs a lab or a budget to understand, and a team that can define all of them in a meeting is already ahead of most of the market. The wider habit — automation under measurement, applied across delivery pipelines — is the subject of The Essential Role of Security Automation in Modern DevOps, and it pairs naturally with everything in this glossary. Keep this page beside you during vendor calls; the moment a salesperson avoids one of these words, you have learned something important about the product.