Two Candlesticks' Matthew Martin on Leveraging AI for Resource-Constrained Security Operations

In this episode of Detection at Scale, Matthew Martin, Founder of Two Candlesticks, shares practical approaches for implementing AI in security operations, particularly for smaller companies and those in emerging markets. Matthew explains how AI chatbots can save analysts up to 45 minutes per incident by automating initial information gathering and ticket creation. Matthew’s conversation with Jack explores critical implementation challenges, from organizational politics to data quality issues, and the importance of making AI decisions auditable and explainable.  Matthew emphasizes the essential balance between AI capabilities and human intuition, noting that although AI excels at analyzing data, it lacks understanding of intent. He concludes with valuable advice for security leaders on business alignment, embracing new technologies, and maintaining human connection to prevent burnout. Topics discussed: Implementing AI chatbots in security operations can save analysts approximately 45 minutes per incident through automated information gathering and ticket creation. Political challenges within organizations, particularly around AI ownership and budget allocation, often exceed technical challenges in implementation. Data quality and understanding are foundational requirements before implementing AI in security operations to ensure effective and reliable results. The balance between human intuition and AI capabilities is crucial, as AI excels at data analysis but lacks understanding of intent behind actions. Security teams should prioritize making AI decisions auditable and explainable to ensure transparency and accountability in automated processes. Generative AI lowers barriers for both attackers and defenders, requiring security teams to understand AI capabilities and limitations. In-house data processing and modeling are preferable for sensitive customer data, with clear governance frameworks for privacy and security. Future security operations will likely automate many Tier 1 and Tier 2 functions, allowing analysts to focus on more complex issues. Security leaders must understand their business thoroughly to build controls that align with how the company generates revenue. Technology alone cannot solve burnout issues; leaders must understand their people at a human level to create sustainable efficiency improvements.