What Is HITL (Human-in-the-Loop) in Cybersecurity?

On the second day of one of our earliest pilot engagements, SocGenie's agent swarm produced a high-confidence recommendation to revoke the CFO's active session. The investigation was thorough: the account had signed in from three new geographies in the preceding 40 minutes, a phishing precursor had been flagged in the inbox earlier that day, and the IOC enrichment agent had returned a 72/89 VirusTotal score on the source IP.

The recommended action landed in the MSP's Slack channel as a HITL gate. A human analyst — not the AI — looked at it, spotted that one of the "new geographies" was a corporate VPN node in Frankfurt, and rejected the session revoke.

The CFO was in the middle of a £12M acquisition call. A session revoke would have ended the deal.

That's the case for human-in-the-loop in one paragraph. Not a philosophical argument about AI safety — a real incident, a real near-miss, a real human who caught what a 95%-confident AI couldn't.

Why total automation is the wrong answer

"The future is fully autonomous SOC" is a marketing line. It's not an engineering position.

Destructive security actions are irreversible in the short term. Revoking a session, disabling an account, blocking an IP, quarantining a file — all of these cause immediate business impact, and some of them are ambiguous to undo. If your agent is wrong once in twenty, and you run 5,000 alerts a month, you are producing 250 incorrect destructive actions every month. Even if most are harmless (a locked-out user reboots and reauthenticates), a few will be catastrophic — a board member during a pitch, a surgeon at 3 a.m., an auditor mid-evidence-pull.

The technology isn't the problem. The policy choice to skip human review is.

What HITL actually means

Human-in-the-loop, borrowed from autonomous-systems engineering, is a simple pattern:

1. An automated system does all the work up to a decision point.
2. At the decision point, a human is required to approve, reject, or choose an alternative.
3. The system cannot proceed without human action. Timeouts escalate rather than default-proceed.

In a SOC, this means investigation runs autonomously (read-only, no blast radius) and action requires human approval (write, irreversible). The AI does the cognitive heavy lifting; the human retains the accountability.

What a HITL gate looks like in practice

Here's what the analyst sees when SocGenie hits a HITL gate:

The analyst has four pieces of information that matter: confidence score, blast radius, evidence summary, and ATT&CK mapping. They have three choices: approve the recommended action, choose a less destructive alternative, or reject outright. Each decision is logged with timestamp, user identity, and rationale (if provided).

HITL vs. copilot vs. full automation

Copilot AI doesn't scale — the human still drives every investigation. Full automation doesn't carry accountability. HITL is the only model that compresses investigation time and keeps a human accountable for consequential actions.

Why HITL matters for UK compliance

UK audit and regulatory frameworks — ISO 27001, SOC 2, FCA operational-resilience guidance — all care about accountability chains. When something goes wrong, an auditor needs to know who decided what, when, and why.

A fully automated SOC produces logs that say "agent revoked session at 14:23:04." That's not an accountability chain; it's a system log. When your regulator asks "who authorised this?", the answer has to be a person.

A HITL SOC produces logs that say "agent recommended session revoke at 14:23:04 with confidence 92%. Analyst jane.doe@msp.co.uk approved at 14:23:47 with rationale 'matches known BEC pattern, CFO not travelling per calendar.' Session revoked at 14:23:51." That's tamper-evident, timestamped, signed, and readable as legal evidence. One of our customers used exactly this kind of log as admissible evidence in a civil case following a BEC attempt.

How to introduce HITL

If you're adding agentic AI to an existing SOC, here's the sequencing we recommend:

• Start read-only. Run agents for investigation and enrichment only. No actions. Calibrate confidence scores against analyst judgement for 2–4 weeks.
• Add low-risk actions. Ticket creation, Slack notifications, evidence attachments. HITL not strictly required but useful for audit.
• Add HITL gates for destructive actions. Session revokes, account disables, firewall rules. Require approval. Log every decision.
• Never add full automation of destructive actions. Revisit this every 12 months; the answer shouldn't change.