AI tooling for security analysts is past the demo phase. The interesting question is no longer what is possible - it is what is worth the time, what is safe to feed, and what creates real leverage for a tier-1 or tier-2 analyst.
The categories that hold up under production pressure: alert summarization, IOC enrichment, draft incident timelines, and report writing. The categories that look flashy and disappoint: autonomous investigation, full incident response, and threat hunting without human framing.
Treat AI like a junior analyst with perfect recall and zero intuition. It will produce a draft. You verify, you decide, you sign your name to it. The signature, not the model, is what makes the work professional.