Faster detection and better triage surface more decisions that humans need to make. Before AI, a SOC might process 200 alerts daily and make 50 meaningful decisions. Now AI surfaces 2,000 alerts, auto-closes 1,700, and escalates 300 that require human judgment. The decision load tripled. Detection speed improved. Decision velocity did not. The industry started in the middle of the IR cycle because triage is analytically complex but operationally simple. No write access required. No change management. No risk of breaking production. Detection engineering sits left, tangled
 in log pipelines and alert volume constraints. Response sits right, blocked by API limitations and organizational risk aversion.