Executive Demo · Microsoft Security Copilot · ~6 min
The human side of Security Copilot.
Security Copilot generates a threat response in 52 seconds. A human approves it. The question for the CISO, CFO, CEO and CRO: is that human qualified to act on it?
Persona · Marcus Webb — AI Governance Lead, Financial Services · HRI 84 Advanced
| Use case | CISO managing an AI-assisted SOC — measuring, monitoring, and evidencing analyst qualification to approve Security Copilot recommendations |
|---|---|
| Audience | CISO, CIO, CRO, General Counsel, Chief Compliance Officer, internal audit and external regulator preparation |
| Structure | Part 1: Context · Part 2: Without AITR (the gap) · Part 3: With AITR (the fix) · Closing |
| Persona | Marcus Webb — AI Governance Lead, Pantheon Financial Group |
| Team | SOC analyst team on Microsoft Security Copilot · avg HRI 66.4 · Intermediate · Oversight capability gap |
| Frameworks | NIST AI RMF · EU AI Act Art.14 · ISO 42001 cl.8.4 · SOC 2 · DORA · NIS2 |
Threat assessment. Confidence score. Recommended action.
Microsoft Security Copilot processes thousands of signals and produces a recommendation in under sixty seconds.
But the output doesn't execute itself. A human analyst reviews and approves before an endpoint is isolated or credentials are revoked.
The question: is the human reviewing your AI outputs qualified to act on them? Most organisations have invested in the AI. Very few have invested in the human who approves it.
fydelitics.aiMicrosoft Security Copilot
Incident 4471 · Lateral movement detected
Confidence
87%
Signals correlated
14
Time to assess
52s
AI-generated summary
Lateral movement pattern detected originating from EP-112. 3 endpoints affected. Affected accounts: ACC-441 (Finance Director), ACC-887 (Treasury Analyst).
Recommended action
Isolate EP-112, EP-334, EP-891 · revoke credentials for ACC-441, ACC-887 · escalate to Tier 2.
'Approved by Marcus Webb, 14:34.' That is all it says.
Marcus approves. Endpoint isolation begins. Credentials are revoked. In two minutes, the Finance Director can't access her own systems.
The audit log says: approved by Marcus Webb, 14:34. No rationale. No framework. No record of whether his judgement was informed by SR 11-7 or NIST AI RMF.
fydelitics.aiAnalyst Action — logged
APPROVEDUnanswerable.
Six weeks later, the AI governance auditor asks a straightforward question. Not was the AI good enough. Was the human good enough.
Under NIST AI RMF, that question has to be answerable. Right now, it isn't.
fydelitics.aiAI Governance Audit — Q2 2026
Auditor question
"Please provide evidence that the human reviewer of Incident 4471 was qualified to approve an AI-generated threat response under NIST AI RMF."
Response field
— blank —
Supporting documentation: none attached
Invisible until something goes wrong.
An unqualified approval. An undocumented override. Regulatory exposure.
All three are invisible — until the auditor asks.
fydelitics.aiUnqualified approval
Analyst approves output outside their expertise. Wrong action taken on a correct AI recommendation.
Undocumented override
Analyst overrides AI without documented rationale. Audit trail incomplete.
Regulatory exposure
No evidence of human readiness. Gap under NIST AI RMF, EU AI Act Art.14, ISO 42001 §8.4.
Security Copilot is certified.
The infrastructure is compliant.
The human is unmeasured.
HRI 84 · Advanced · NIST AI RMF qualified.
Marcus has a readiness profile. Five-course path complete. Framework scores above threshold across NIST AI RMF, ISO 42001, OECD Principles.
The platform already knows Marcus is qualified to act on AI-generated outputs in this decision context.
fydelitics.aiAI Decision Readiness
Marcus Webb · AI Governance Lead
Financial Services · Technology function
HRI
84
Advanced5 courses complete
4 Navigator sessions MTD
Oversight
88
Operations
86
Risk
82
NIST AI RMF
85.7
ISO 42001
82.3
OECD AI
84
Qualification surfaced inside Security Copilot.
The same incident. But at the moment Marcus picks it up, his readiness profile is surfaced in context.
HRI 84. Advanced. NIST AI RMF qualified. The platform has already answered the question — and it will be in the audit record.
fydelitics.aiSecurity Copilot · Incident queue
HIGHIncident 4471 · Lateral movement
EP-112 → EP-334 → EP-891 · ACC-441, ACC-887
Last Fydelitics.ai activity: 13 May 2026
Analyst qualification verified by Fydelitics.ai. Decision authority confirmed.
Five specific steps. NIST AI RMF GOVERN 1.7.
Marcus asks: what are my NIST AI RMF obligations before I approve a credential revocation triggered by an AI threat assessment?
The response is grounded in NIST AI RMF and the Fydelitics.ai scenario bank — calibrated to his Advanced qualification. Step 4: record your decision rationale.
fydelitics.aiAI Decision Navigator
HRI 84 · Advanced"Security Copilot recommends isolating 3 endpoints and revoking credentials for a Finance Director and Treasury Analyst. What are my NIST AI RMF obligations before I approve?"
Based on your AI Governance Lead role and NIST AI RMF Advanced qualification:
- 1Verify the model's confidence threshold meets your minimum for automated action — 87% requires human verification per NIST AI RMF GOVERN 1.7.
- 2Confirm affected accounts (ACC-441, ACC-887) are within the model's intended deployment scope for this incident class.
- 3Document your independent assessment of the lateral movement indicators — do not rely solely on the AI summary.
- 4Record your decision rationale, including whether you agree with the AI's confidence score and what evidence you reviewed.
- 5If approving credential revocation for senior roles (Finance Director), escalate notification to the CISO in parallel.
Same action. Completely different audit log.
Marcus approves. Same action as before. But the audit log now contains his rationale, the signals he reviewed, the framework he applied, his HRI at the moment of decision, and a reference to the Navigator query.
When the auditor asks if the human was qualified — there is a complete, timestamped, verifiable answer.
fydelitics.aiAnalyst Action — logged
APPROVED · evidencedDecision rationale
Reviewed 14 correlated signals. Lateral movement pattern consistent with credential-based pivot. Confidence 87% meets threshold. Accounts ACC-441 and ACC-887 within model deployment scope. Escalation notification sent to CISO per NIST AI RMF GOVERN 1.7. Approving endpoint isolation and credential revocation.
Evidence pack attached.
The same question. Now answerable. HRI 84. NIST AI RMF 85.7. The decision rationale. The Navigator query. The certification record.
Every element of Marcus's readiness is documented, timestamped, and traceable to his specific decision.
fydelitics.aiAI Governance Audit — Q2 2026
Auditor question
"Please provide evidence that the human reviewer of Incident 4471 was qualified to approve an AI-generated threat response under NIST AI RMF."
Fydelitics_Evidence_Marcus_Webb_4471.pdf
Marcus Webb · HRI 84 Advanced · NIST AI RMF 85.7 · approved 19 May 2026 · 14:34
Same analyst. Same AI. Same incident.
One outcome leaves the organisation exposed. The other closes the loop.
fydelitics.aiThe human readiness layer that makes Security Copilot enterprise-safe.
Capability Builder to certify the analyst before they act.
Readiness Control Plane to measure their qualification continuously.
Decision Navigator to guide them at the exact moment a recommendation arrives.
fydelitics.aiFydelitics.ai
Human readiness layer
Microsoft
Security Copilot
Capability Builder
Certify the analyst before they act
Readiness Control Plane
Measure qualification continuously
Decision Navigator
Guide them at the moment of decision