AI Can Fill the Template. It Cannot Own the Verdict.
Your assistant filled in the whole investigation before you opened the ticket. How to use that speed without handing it your judgment.
A new alert opens and the investigation is already there.
A timeline, built and ordered across every log source. All five sections of the template filled. Indicators listed and rated. A verdict at the bottom:
Medium, leaning benign, probably a scheduled task. You have not written a word of it.
The triage assistant reached the ticket first. The work is good. It did in nine seconds what would have taken you twenty minutes.
The alert is svc-backup, the backup service account, authenticating to a cluster of hosts it has no schedule for, off-hours, in a burst of SMB. You have seen the account a hundred times. It runs at night, that is its job. WHO, in the filled template, reads: the backup service account. The top hypothesis is a misconfigured backup job.
It is the back half of a long shift, forty cases behind this one, and the work is already done. Your cursor is on the confidence field, ready to confirm medium-benign and move on.
That is the part that should bother you. Everything in the case agrees with everything else, because one source produced all of it.
You have read this series. You have the template. You know its five sections were each built to stop a specific bias from closing a case too early. But there is one question the filled-in template does not answer. The bias defences live in the work. If the machine did the work, where did the defences go?
The anchor arrives pre-written
The pull to accept a filled-in case because a system filled it in is automation bias.
It is well documented in human-factors research. Parasuraman and Riley, Skitka and colleagues: people defer to automated output, scrutinize it less than they would a human’s, and stop verifying once the machine has spoken. The effect gets worse under load. The busy shift with cases queued up is the exact condition the research describes.
In the previous pieces, the anchor was your own. Your System 1 looked at a live session and a known account and wanted to close the case, and the WHO cell was where that anchor lost its grip. The anchor came from inside you. With practice, you could feel it coming.
This anchor does not come from inside you. It arrives pre-written, in confident prose, with a confidence score attached. Put the research finding next to that difference and the conclusion follows: a machine-supplied anchor is stickier than your own, because it carries an authority your own never had. The system said so. You did not have to think for it to take hold. It was waiting for you when you opened the ticket.
Notice what the verdict does to you prior. You already believed the account was benign; now the machine agrees, and confirmation bias and automation bias pull in the same direction. You met the first of those two posts ago. This is the two of them working the same case.
This is the shape of a shifting workflow. The model writes the first draft. Sometimes it is right. Sometimes it is fluent and wrong, which is more dangerous than incoherent and wrong, because fluent and wrong passes review. Your job moves from producing the analysis to judging an analysis that already exists.
The discipline that judges a machine’s draft is the same discipline that judged your own. You already built it, you just have to point it at a new source.
Assemble, then weigh. Now across the whole page.
Where does pre-filling help, and where does it quietly hand you back the bias the template was built to remove? The answer is different in each section, and the difference is the whole method.
Start with the line you already drew. In the last post, Section 3 split evidence into two moves: assemble, then weigh. Assembling is fetching and listing. Weighing is judgment. That single split is the key to the entire template under AI. Extend it across every section.
AI is built for the assembling. It is fast, tireless and good at pulling scattered data into one place. It is not built for the weighing, because weighing is where the bias defences live, and those defences are judgments a model cannot make for you. So the rule is one line. The machine assembles. The analyst weighs.
The timeline is the clean win. Pure assembly: pull events from five sources, normalize to UTC, order them. High toil, low judgment, exactly the work you want to hand off. But the weighing stays yours, because a gap in the timeline is a judgment, not a fetch. The model shows you the events that exist. Only you decide whether an hour with no logs is a quiet hour or a blind spot.
The 5W+H splits down the middle. WHERE and WHEN are facts. Let the model fill them. HOW splits: the mechanics are assembled, the naming of the mechanics is weighed. WHO and WHY are not facts. They are framing, and framing is where the anchor lives. The model wrote "the backup service account." That is the anchor, pre-packaged. The weighed version is "a session authenticating with svc-backup's credentials," which leaves open what the first phrasing quietly closed: the account is not the same thing as whoever is using it. You do not let the model fill WHO. You make it show you the authentication events, and you write WHO yourself.
The hypotheses are where pre-filling is most useful and most dangerous at once. Useful, because a model enumerating candidate explanations can surface one you would not have reached and a wider starting set is a real gain. Dangerous, because a ranked list of three plausible hypotheses feels complete, and a list that feels complete ends your search. That is not a wrong-list problem. It is satisficing: you stop at three good answers when the one that mattered was the fourth.
There is a category the model cannot reach, however capable it is. It can only reason over the context it has: its training, and whatever sits in the ticket or the systems it can query. The explanation that lives outside that context, an authorized maintenance window nobody logged, a known-good automation only the team knows about, a piece of knowledge that sits in a colleague’s head and in no data source, is one the model has no way to generate. You do. Treat its list as a floor to build on, never a ceiling that ends the work.
The Admiralty ratings do not move to the machine at all. The model can fill the indicator rows, the hashes and IPs and domains. That is assembly. The rating is the judgment, and the rating is the bias defence, so the rating stays with you. There is one row most analysts forget to add. The model’s own verdict is a source, and like any source it gets rated. The last post set its floor: an LLM verdict on framed indicators starts at F6, cannot be judged, until independent evidence corroborates it. The confident benign rating the assistant attached to your case is not evidence. It is a claim awaiting one.
Weigh the case in front of you
The assembly is good. Take all of it. The timeline is real, the events are ordered, the indicator rows are filled. Twenty minutes of toil, delivered in nine seconds. That part of the bargain is genuine.
Now weigh it, starting with a contradiction that has been sitting on the page since you opened the case. The verdict says probably a scheduled task. The timeline, the machine’s own timeline, says svc-backup authenticated to a cluster of hosts it has no schedule for. The verdict contradicts the assembly it was built on. The model wrote both halves and never flagged the tension. A sharper model might have caught it. It does not matter. You cannot know, case by case, which drafts were weighed well and a defence that fires sometimes is not a defence. The weighing stays with you not because the machine never can, but because it cannot be relied on to.
Nothing here says attacker. Maybe a colleague changed the backup scope yesterday and nobody logged it. Most of the time, that is exactly what it will be. But most of the time is a base rate, not a verdict on this case.
So you make the weighing moves. Strike “the backup service account” from WHO and write what the evidence supports: a session authenticating with svc-backup’s credentials. Add the assistant’s verdict to the indicator table as its own source, rated where it starts, F6, a claim awaiting corroboration. Then go find the hypothesis the model could not generate: the change record, the colleague, the undocumented maintenance window. If it exists, the case closes benign, and it closes on evidence instead of fluency. If it does not exist, you are no longer looking at a scheduled task.
The whole discipline compresses to one pass, section by section. Run it on every pre-filled case:
Timeline. The machine fetches, normalizes, orders. You judge the gaps: is a quiet hour quiet, or blind?
5W+H. The machine fills WHERE, WHEN, and the observed HOW. You write WHO and WHY yourself, in wording that stays open. Naming the HOW is yours.
Hypotheses. The machine enumerates a floor. You add what lives outside its context, and you decide when the search ends, not the length of its list.
Indicators. The machine fills the rows. You rate every source, and the machine’s own verdict enters the table at F6.
Verdict. The machine, never. You, always.
The verdict stays home
The template was built to slow you down at exactly the moments a bias wanted speed. Pre-filling removes the slowness. It does not remove the moments. Every one of them is still in the case, waiting for a weigher, and the machine that filled the page is not it.
That is the trade on offer, and taken on these terms it is a good one. You give up the toil. You keep the judgment. The analyst who accepts both halves of the machine’s work is not being augmented. The analyst who accepts the assembly and owns the weighing is.
One question is still open and it is harder than this one. The judgment you just applied was trained by years of doing the assembling yourself. You could weigh the timeline because you have built a thousand timelines. What happens to the next analyst, the one who never does the toil, when the weighing is needed? That is where this series goes next.
The template can be filled in nine seconds. The verdict still takes an analyst.