Straining at Nats and Swallowing Camels

The bottom line is AI needs to replace humans in some capacities.
Not because people don’t matter—but because judgment does.
Otherwise, we will keep straining at gnats and swallowing camels.

The CEO of a Fortune 500 company in the defense sector once asked me,
“What are your thoughts on how effectively we are configuring our cybersecurity defensive measures?”

I told him we were straining at gnats and swallowing camels.

That got his attention. He asked me to explain.

At the time—and in many organizations still—we overinvested in cybersecurity policy and compliance. Payroll in that division grew disproportionately large, not because risk demanded it, but because governance defaulted to paperwork over judgment.

We staffed humans into roles automation could easily handle. At the same time, we underinvested in skilled analysts who could interpret weak signals, recognize novel threats, and respond to ambiguity inside our networks.

The risk was workforce misallocation driven by compliance-first governance rather than threat-first prioritization.

We treated low-impact, rule-based risks as mission critical while neglecting high-impact threats that required human judgment.

The risk was workforce misallocation driven by compliance-first governance rather than threat-first prioritization.

We treated low-impact, rule-based risks as mission critical while neglecting high-impact threats that required human judgment.

Instead of correcting course, we made the problem worse.

We bought more technology—then used highly trained cyber analysts to process more paperwork for events that never became events because automation already prevented them.

We enforced arcane policies that removed user access for trivial violations—plugging a phone into a laptop—then paid skilled professionals to sit idle while real analytical work went undone.

The system looked busy.
It looked compliant.
But it grew less effective.

Business and Mission Consequences

• Skilled analysts performed clerical work
• Technology layered onto broken workflows
• Payroll increased while defensive effectiveness declined
• High-consequence threats received less human attention, not more

Cyber defense did not fail because we lacked policy.
It failed because governance misused human judgment.

AI is not the problem.
Misgoverned judgment is.

AI should replace humans in rule-based, repetitive, compliance-heavy tasks so human judgment can focus on ambiguity, anomaly, and consequence.

This is not workforce reduction.
It is judgment preservation.

When leaders automate without redesigning:

• Roles
• Decision rights
• Accountability
• Risk prioritization

They do not gain efficiency.
They scale dysfunction.

AI will not replace people.
It will expose whether leadership ever understood what people were for.

Categorized in: General