When to bring in a human
Roughly half of first-line security work automates and roughly 40% does not. The signals that mean stop and telephone somebody, and where to buy that person.
This is the least flattering article in this knowledge base and probably the most useful one. It is about the boundary of what Qorionix can do for you, where that boundary actually falls, and what you should have arranged before you reach it.
The headline, stated once and plainly: there is no human on call unless you have your own. Sentinel-Q investigates every alert within minutes, around the clock, with cited evidence. Nobody at Qorionix is watching your estate at three in the morning, and any vendor language that let you believe otherwise would be contradicted by our own software within a week of you signing up.
Tier 1, Tier 2, Tier 3 — the words the industry uses
Security operations work is conventionally split into three levels, and knowing them makes every vendor conversation you have from now on clearer.
- Tier 1 — the first pass
- Read the alert, gather the context, look up whether the address or file is known-bad, decide whether it is worth anybody's attention, and follow the written playbook if it is. High volume and largely repetitive. This is the tier Qorionix automates.
- Tier 2 — the investigation
- The cases the first pass could not settle. Working out whether the administrator running an unusual tool is your IT contractor doing their job or somebody using your IT contractor's account. Reconstructing a sequence across systems. Deciding what to do when the playbook does not fit. This tier is yours.
- Tier 3 — the specialist
- Forensics, novel threats, and decisions with legal and financial consequences attached. Rare, expensive, unavoidable when needed. Yours too, and you almost certainly buy it rather than employ it.
Where the evidence says autonomy stops
This is not our opinion about our own product. Every major vendor in this market converged independently on the same boundary and states it explicitly: the AI acts only within pre-approved policy. The most aggressive published claim in the category is sub-two-minute containment, and its own vendor qualifies it as applying only to high-confidence threats, with human oversight and escalation behind it.
The work splits roughly in two. Around 50 to 60% of Tier 1 automates well: alert enrichment, indicator lookup, known-pattern response and playbook-driven workflow. Around 40% does not automate today, and the four categories it falls into are worth reading carefully, because they are the four moments when you need to be in the room.
| What does not automate | What it looks like for you |
|---|---|
| Contextual judgement | Distinguishing legitimate administrator tooling from an attacker using the same tools — the technique the industry calls living off the land. The software sees the same commands in both cases. What separates them is knowing that your bookkeeper does not normally run remote administration scripts, and no amount of telemetry supplies that. |
| Novel-threat analysis | Detection works on known patterns. A patient adversary who studies your business and uses no recognisable technique is outside what any product at this price detects, and we will not claim otherwise. Novel attacks are what we escalate to you. |
| Customer and stakeholder communication | Telling a client that their data may have been exposed, briefing your board, drafting a regulator notification. These are judgement calls about tone, timing and liability, made by somebody whose name goes on them. |
| Absorbing liability | Somebody has to decide to take a system offline during business hours, to pay or not pay, to notify or not notify. Software does not carry that, and a vendor implying it does is selling you a comfort rather than a control. |
The four signals that mean stop and call someone
These are specific and checkable rather than a general instruction to use your judgement. Each one is a thing you can see on screen.
The verdict is an escalation
Sentinel-Q has a vocabulary for saying it has reached the end of what it can settle, and escalation is not a failure state — it is the product working correctly. It means the platform gathered the evidence, formed a view, and concluded that the next decision needs a person. Treat it as the strongest signal on this list, because it is the one the software raised about itself. See Agree, disagree or escalate.
The evidence could not be corroborated
Every claim in a decision is checked back against the evidence the platform actually holds, and a verdict whose citations do not verify cannot trigger an automated action however confident it sounds. What you will see instead is a low confidence band with its reason — something in the shape of could not corroborate sign-in geography, source offline. That sentence is not a hedge. It is telling you that the platform is reasoning about something it cannot see, which is precisely the condition under which a human should take over. See Grounding: why a confident answer can be refused.
It touches privileged access
Granting, extending or elevating privileged access is never automated, at any autonomy tier and at any confidence — the capability is not exposed to the AI at all, so it cannot be requested by a cleverly worded prompt. Rotating a domain controller, root or emergency-access credential is never automated either. If an alert leads you toward any of those, you have arrived at a decision that was designed to require a person, and the person should be one who understands what breaks.
The product says it cannot see the data
A check that cannot see its data is reported as skipped, never as passed, and a coverage gap names the dataset it is missing. When your response to an alert depends on an area the platform has told you it cannot observe — because of a licence limit, a permission that was never granted, or a source that is not connected — you are working blind in exactly the place that matters. Fill the gap if you can. If you cannot, escalate rather than guessing. See When a check cannot run.
Two situations always need a specialist regardless of what the console says, and both are on the response playbooks with that requirement stated: anything that looks like ransomware before encryption has started, and anything that looks like an attempt at financial fraud. Those are the two categories where working through it alone goes wrong most expensively, and where the decisions are legal and financial as much as technical.
The thing we do not sell, and will not pre-sell
There is a human escalation add-on on our pricing page — a named security specialist for the cases the platform escalates, delivered with a partner, indicatively priced at €6 per identity per month. It is marked not yet available, and that is not a queue you can join.
It does not exist yet and we will not pre-sell it. If you need a human on the phone at 3am today, buy that from someone who has one.
We publish the price of a thing we do not sell for one reason: so that a prospect can see the shape of the eventual offer and decide whether to wait or to buy elsewhere now. Like everything else on the pricing page, the figure is provisional and not yet contractual.
This is a business-model boundary rather than an engineering one. A 24/7 human security operations centre is deliberately out of scope. Some vendors' actual product is people — analysts who write the detection logic, research threats weekly, validate every high-severity alert inside twenty minutes and pick up the telephone — and they price aggressively because that is their whole proposition. Ours is software. Different bet, honestly stated, and the reason our effort goes into making the escalation handoff excellent rather than into pretending it never happens.
Where to buy a person
You do not need one on retainer to be sensible about this. You need to know, before anything happens, which of these you would ring.
- Your cyber insurer's incident-response panel. If you hold a cyber policy, read it now rather than during an incident. Most policies name an approved responder and most require you to use them — calling somebody else first can affect the claim. This is the cheapest option on the list because you are already paying for it.
- An incident-response retainer. A firm that will answer out of hours and knows your estate in advance. Priced per hour with a small annual commitment, and the commitment mostly buys you the answered telephone rather than the hours.
- A managed detection and response provider. Vendors whose product is a staffed operations centre. Worth considering seriously if you conclude you want people rather than software; we would rather tell you where to buy that than imply we are it.
- Your national computer security incident response team. Every EU member state has one, they are a public body, and for a small organisation facing something serious they are a legitimate first call. Find yours and note the number now.
- Your own IT contractor, with a prior conversation. They are not a security specialist, but they know your estate and they can be reached. Agree in advance what they will and will not attempt on their own.
The ten minutes to spend today
Write down two telephone numbers: who you call for suspected ransomware, and who you call for suspected payment fraud. Add who is the fallback when the first person is unreachable, and note whether your insurance policy constrains the choice.
Then put that piece of paper somewhere that does not require Microsoft 365 to read. A contact list that lives only in the mailbox an attacker is sitting in is not a contact list. This is the most valuable ten minutes in this entire knowledge base, and almost nobody spends it until the second time they need it.
What to do next
- What to do when an alert arrives — the order to work an incident in before you decide whether to escalate.
- Agree, disagree or escalate — what each of the three responses to a decision actually does.
- What Qorionix does, and what it does not — the published hard limits, in the same tone as this article.
- Read the claims we refuse to make — including the ones about being a security operations centre.