Explain why an organization should balance automated detection tools with human oversight.

### The concept Automation performs defined tasks at speed and can improve efficiency or reliability. However, a tool must be selected, operated, and reviewed, so it has an operational cost. Analysts add context by interpreting data and deciding whether unusual behavior represents a threat. End users also provide observations, such as reports of suspected phishing, that may not be captured by automated controls. ### What a good answer covers - Explain at least one benefit of suitable automation. - State that automation has limits and consumes organizational capacity. - Describe how analysts interpret alerts and separate threats from normal variation. - Recognize that end users can contribute detection signals. ### Terms - **Phishing**: A deceptive attempt to get someone to disclose information or take an unsafe action. ### Remember Tools collect and flag evidence; people help decide what it means and what to do.