Buyers of expensive assets learn a hard rule early: the glossier the brochure, the longer the due-diligence list. AIOps for Security — learning software that spots anomalies, ranks alerts, and increasingly closes cases on its own — has reached the asset class where that rule applies in full. The category is real and improving; the contracts around it, in most rooms, have not caught up. Four structural problems show up again and again when these deals go wrong. Diagnose each one before signature and the failure modes mostly disappear; this piece walks the diagnosis and ends with the six clauses that fix it. The audience in mind is the one this site serves — owners and stewards of expensive, hard-to-replace assets — because the reflexes transfer perfectly, and the money at risk is the same shape.
The Problem: Automation Promises Outrun the Paperwork
The pitch usually contains a number — “automates 80% of triage”, “99% accurate” — and the contract usually contains none of the scaffolding that would make the number checkable. Analysts have catalogued the pattern under the label AI washing: conventional rule engines presented as learners, marketing metrics standing in for measurements. Gartner coined the phrase, and the underlying failure is a familiar one to anyone who has bought technology before: adjectives where nouns should be. The stakes deserve spelling out once. A single missed intrusion at an asset-holding business — client records, transaction histories, security schedules — is not an IT line item; it is a valuation event. The four diagnoses below convert the adjectives back into nouns, which is where they can be negotiated.
Diagnosis One: There Is No Watch Phase
Serious deployments begin silent — the machine takes notes while every decision stays human — and earn autonomy rung by rung. Some products skip that phase by design: one major vendor’s phishing agent started shutting down genuine mail the moment production began, and its documentation showed no observe-only switch as of October 2026. A contract silent on the watch phase inherits whatever the product does. The fix costs one sentence: autonomy starts at observe, and each rung up requires written acceptance of evidence the buyer has actually seen. The observe phase is not dead weight either — it manufactures the labelled history that every later evaluation needs, so the quiet month pays for itself twice.
Diagnosis Two: The Metrics Are Pooled
A blended accuracy figure is a hiding place. In one published programme, phishing misses read 9.1% blended — a presentable number — while cloud-identity misses inside the same average had reached 42.3%. The buyer who accepted the blend was approving the worst category without ever seeing it. Contracts should therefore require per-category reporting as a standing obligation, on a stated cadence, with the worst category displayed at least as prominently as the average. Any resistance to that clause is itself diagnostic. An operator who cannot say how the machine performs category by category either has not measured it or did not like the answer — and a buyer can negotiate with either admission, but not with a blended average.
Diagnosis Three: The Sampling Is Theatre
Vendors love spot-checks, and spot-checks of routine work prove almost nothing. Statistics of rare events are unforgiving: n clean cases only cap the error rate near three-over-n, so two hundred flawless closes still leave room for doubt that any board would accept on other assets. One miss raises the sample needed to defend a 2% ceiling to 236 cases; two misses, to 313. A 5% random sample of a quarter’s closes — a common audit habit — can return zero findings while the true miss rate sits near 38%. Honest assurance uses planted cases instead: seeded threats set on a calendar, privileges pulled automatically once several slip through undetected. Due diligence should accept nothing less. Who runs the plantings matters as much as whether they exist: the buyer’s own team — not the vendor’s — should hold the seeding calendar, or the audit grades its own homework.
Diagnosis Four: Privileges Creep
Autonomy granted loosely does not stay put. A tool licensed to recommend begins closing; one licensed to close begins acting; and each step feels reasonable in the meeting where it happens. The discipline that prevents creep is a register: observe, recommend, close, act — each rung named, each entry condition written, each promotion requiring fresh evidence, and the irreversible rung marked as permanently human. Boards review asset-management mandates in exactly this form for aircraft and property; software autonomy deserves the same governance, and the buyer’s lawyer should treat the register as a schedule to the contract rather than a wiki page. Creep usually arrives dressed as convenience — “just let it close the obvious ones” — so the register should also name who is allowed to propose a promotion, and require the proposal in writing with the evidence attached. Friction, here, is a feature.
The Fix: Six AIOps for Security Clauses to Demand
- The watch clause: deployment starts at observe; no autonomous behaviour until the buyer signs off on named evidence.
- The categories clause: per-category miss reporting on a stated cadence; blended averages expressly non-conforming.
- The bounds clause: autonomy claims stated as bounds with sample sizes attached, not as percentages alone.
- The canary clause: the buyer may plant seeded cases at will; undetected plantings trigger demotion without penalty.
- The register clause: the autonomy register attached as a contract schedule, changes in writing, withdrawals effective immediately.
- The exit clause: on termination, the buyer receives its labelled history and the register in portable form — the asset it spent months building.
None of the six is exotic. All six appear in mature data-centre and fleet contracts in some form, which is precisely why vendors cannot honestly call them unreasonable. Introduce them early — ideally in the first call, framed as standard practice rather than suspicion — and they become part of the deal’s shape instead of a late-stage fight.
AIOps for Security Due Diligence, Summed Up
One practical step precedes every clause: inventory the automated decisions already allowed in the business today. Most owners are surprised by the count — password resets, ticket closures, session revocations — because the permissions accumulated one convenience at a time. That inventory becomes the baseline the six clauses formalise, and producing it usually takes a single afternoon with the logs.
The pattern across all four diagnoses is one an asset buyer will recognise immediately: substitute evidence for narrative, and most of the risk leaves the room. A parallel discipline applies to the machine’s own inputs — a file handed to an outside scanning service can reach that service’s paying customers, the majors state as much in their own terms, so diligence should cover where samples travel too. Teams governing autonomous systems more broadly will find the same structures in our piece on agentic AI and LLMOps architecture governance, and the incident-side mirror of these ideas appears in our approach to practical incident management for robot failures. Asset-minded readers may also enjoy how the same verification instinct drives our strategy for elite property buyers — different market, identical reflex. For the vocabulary behind every clause above, the Ops Atlas reference covering AIOps for security holds the ladder, the bounds, and the evaluation standards in one place. Buy the machinery, by all means — but buy it the way you would buy anything irreplaceable: with the evidence in writing before the money moves.
