Agentic Cyber Explorerby Fide AI · PreviewPreview
Dilemmas/FID-076

Contain or wait

An AI defender sees an alert. It can isolate the host now, which stops a real attack quickly but disrupts legitimate work when the alert is wrong. Or it can escalate to an analyst, which is more accurate but slower. Where should the line be?

Toy model · illustrates the shape of the tradeoff, not a measured result
Alert score above which the agent isolates the host without asking.
How long an analyst takes to act on an escalation.
How well alert scores separate malicious from benign activity.
1.3wrongful isolations per 100 alerts
21minutes to contain a real attack (mean)
90escalations to an analyst per 100 alerts
0204060800306090120wrongful isolations per 100 alerts (service disruption)minutes to contain5 min15 min60 min120 mincurrent delay: 30 min

What to notice

  • There is no free setting. Raising the threshold cuts wrongful isolations and escalates more, so containment waits on people.
  • Approval delay moves the whole curve. A slow approval process makes every threshold worse at containment. Faster review can be worth more than a better threshold.
  • Detector quality is the lever that bends the curve. With a strong detector the curve hugs the corner: fast containment and little disruption at once.

What this model leaves out

Real incidents differ in how reversible an action is, how much damage accrues while waiting, and whether the analyst is right. Analysts under heavy escalation load also get slower and less accurate. Fide’s proposed study under FID-076 would measure these tradeoffs in a contained environment, comparing fixed approval rules with a policy that weighs evidence, reversibility, and current authority.

Practice the judgmentIn the Defense Evidence Lab, Fide’s companion tool for judging what cyber evidence can support. Opens a separate site.

Assumptions: alert scores for malicious and benign activity are normal with standard deviation 0.13; automated isolation takes 2 minutes; analyst review takes 6 minutes after the delay; analysts decide correctly.