We will likely shift our mindset from “reduce false positives” to “reduce hallucinations” as AI agents become companions for security teams. The beauty with this approach is that it encourages the best practice behaviors of right now:

1. Do your best to optimize and tune incoming alerts, but don’t worry about it being perfect

2. Focus heavily on enrichment and surrounding context (identities, systems, behavior baselining)

3. Give your AI agents enough autonomy to combine all the evidence

Eventually, we will trust agents enough to be the first and maybe second line of defense and “context engineer” the pieces of information to improve performance.