Where should AI be refused? Human limits, cyber risk, and the boundaries of automation

AI is being rapidly embedded into cyber security operations, governance and organisational decision-making. Much of the current conversation emphasises capability, efficiency and scale. This panel takes a different starting point: where should AI not be used in cyber work?

Rather than assuming adoption is inherently progressive, this session examines the Operational Limits and Failure Modes of AI-Assisted Security. It focuses on situations in which automation can erode human judgement, create the illusion of oversight, displace risk across teams or time horizons, and weaken accountability in ways that are difficult to detect until something has already gone wrong.

The panel brings together perspectives from human factors, organisational psychology and cyber-adjacent practice to explore a set of live questions. When does human-in-the-loop become symbolic rather than meaningful? When do efficiency gains produce hidden organisational costs? What happens to vigilance, attention and decision quality when AI becomes embedded in monitoring, triage, and response workflows? Under what conditions should AI use be constrained, redesigned, or actively refused?

The session is designed as a moderated dialogue rather than a sequence of prepared presentations. This format allows the panellists to engage directly with areas of disagreement, test assumptions against realistic cyber scenarios, and surface trade-offs that are often flattened in implementation-focused discussions. Audience questions will be built into the session so the discussion remains grounded in the practical concerns of practitioners, leaders, and policy stakeholders.

This panel is particularly relevant to attendees working in security operations, governance, risk, assurance, public policy, and organisational leadership. It will also speak to those concerned with the human consequences of AI deployment in cyber environments, including workload, vigilance, role design, accountability, and long-term system resilience.

Attendees will leave with a clearer framework for thinking about the limits of AI-assisted security. Rather than asking only what AI can do, this panel asks what safe, defensible, and legitimate cyber practice requires. The aim is not to reject AI wholesale, but to give organisations a stronger basis for identifying when its use is justified, when its risks are being displaced or obscured, and when refusal is the more responsible option.

This aligns closely with CyberCon’s focus on empowered, resilient cyber systems by recognising that security failures are not only technical. They are also human, organisational, and governance failures.