{"id":11688,"date":"2026-11-02T07:30:00","date_gmt":"2026-11-02T07:30:00","guid":{"rendered":"https:\/\/www.cotocus.com\/blog\/?p=11688"},"modified":"2026-11-02T07:30:00","modified_gmt":"2026-11-02T07:30:00","slug":"aiops-for-security-primer-glossary","status":"publish","type":"post","link":"https:\/\/www.cotocus.com\/blog\/aiops-for-security-primer-glossary\/","title":{"rendered":"AIOps for Security: A Primer and Pocket Glossary"},"content":{"rendered":"

Security operations has grown its own branch of machine-assisted tooling, and the branch has a name that confuses almost everyone the first time they hear it: AIOps for Security<\/strong>. This primer gives newcomers the minimum working knowledge \u2014 what the term covers, how it differs from the IT-operations AIOps you may already run, and a pocket glossary of the vocabulary used in every serious evaluation. Definitions here follow the working glossary published at this working glossary of AIOps for Security<\/a> in the Ops Atlas, which is the best starting reference we know.<\/p>\n

A short primer on AIOps for Security<\/h2>\n

The label is editorial, not official: no standards body ratified it and no founding paper exists. In practice it names the use of machine learning and large language models inside security work \u2014 anomaly detection, alert ranking, and investigation support \u2014 together with the evaluation discipline that decides how much those systems may be trusted. Two boundary notes matter. First, it is not a synonym for IT AIOps, which correlates infrastructure events; the security variant faces an adaptive adversary and pays breach-scale prices for mistakes. Second, the label excludes its neighbours: containment playbooks, detection engineering, telemetry pipelines, and vulnerability prioritisation all belong to other names. If a product card claims everything at once, read carefully. The working scope, in list form:<\/p>\n