Security has always been more about interpretation than detection. A scanner tells you what's open, a log tells you what happened, and a CVE database tells you what's known, but none of that automatically tells you what actually matters in your environment. That part still takes judgment. That's what interests me about AI in security. Not replacing analysts, but helping them work through more information without losing the context that makes the information useful. Models are already good at explaining things and connecting pieces, but they're also very good at sounding confident when the pieces they were given are incomplete or wrong. The answer to that isn't hard-coding every step of an analyst's thought process either, because that ages badly as models improve. Define the substrate, don't micromanage the script.
Nmap is a great example because it does an excellent job turning messy network observations into useful, structured data. Its output gives you hosts, ports, services, and detected versions that a model can actually reason over. Instead of asking an AI to guess which vulnerabilities might apply, you can give it real scan data, have it check trusted sources, and ask it to explain what it found. But even good evidence has limits. Version detection is still an inference based on what a service exposes, banners can be misleading, and distributions sometimes backport patches without changing the visible version string. A parser can also take something uncertain and turn it into a clean field that suddenly feels authoritative. Then the model reasons carefully over bad evidence and gives you a wrong answer with a beautiful audit trail. So grounding the model doesn't mean blindly trusting the ground.
I keep coming back to the idea that AI should be an amplifier, not an oracle. A shortcut tries to remove the hard thinking. An amplifier helps you do more of it. I don't want a security tool that just gives me a confident answer. I want one that makes it easier to see what we know, what we're assuming, where the information came from, and what still needs to be verified. The same idea applies beyond Nmap: logs, tickets, source code, alerts, cloud configurations, whatever. Give the model access to real evidence, let it compare sources and explain what it found, but don't pretend that a clean answer means the underlying reality is clean too.
Then there's the phrase everyone uses: keep the human in the loop. That sounds right until the review volume gets too high and the human starts rubber-stamping everything. At that point, human oversight is mostly theater. So I don't think the answer is that humans should decide everything. The harder question is which decisions actually need human judgment and which ones can safely be automated. I don't have a clean answer for that yet. AI in security is going to become more agentic either way, and I'm fine with that as long as it can show where its claims came from, separate observation from inference, and admit when it doesn't know. Autonomy backed by evidence could be useful. Autonomy backed by confidence alone is just a liability.