What Does “Intuition Work” Mean for Security Engineers — and Are You Ready for It?

For years the narrative was about augmentation: AI makes security engineers faster, more accurate, better at handling volume. The human stays in the loop while the tool handles the tedious parts. It was a comfortable story because it kept the profession’s value proposition intact.

That story is over. Shan Kulkarni, co-founder and CEO of Nullify and guest on the latest episode of the *To the Point Cybersecurity Podcast*, makes a distinction that cuts through the augmentation framing cleanly: AI was making practitioners 30 or 40 percent more productive at triaging alerts and resolving vulnerabilities. Now it can do those things outright. That’s not augmentation. That’s substitution. And the question it raises is not how security teams use AI to work better — it’s what security engineers do when AI is doing what they were doing.

[embed]

What knowledge work and intuition work are

Kulkarni draws a line between two categories of work. Knowledge work is what security professionals have spent careers building expertise in: analyzing findings, triaging alerts, assigning vulnerabilities, validating exploits, routing tickets. It is skilled, it requires training, and AI is now genuinely capable of performing most of it. Intuition work is what remains — and what becomes the actual job. It involves business risk communication, connecting the dots across domains that don’t naturally talk to each other, and engaging stakeholders across an organization in ways that require judgment, context and trust that no tool can replicate.

The shift isn’t hypothetical. Kulkarni sees it happening already: security teams whose AI handles the investigation and triage layer are discovering that the remaining work looks more like being an interpreter between the security program and the rest of the business than it does like traditional security engineering.

What intuition work demands that most security careers didn’t develop

The uncomfortable part of this shift is that most security career paths were not built around intuition work. Technical depth was the signal of competence. Specialization was rewarded. The ability to write a good triage report or communicate business risk to a CFO was treated as secondary — useful, but not the core of the job.

Kulkarni is specific about what the intuition layer actually requires in practice: understanding business risk well enough to translate a vulnerability into an outcome the board can act on, engaging engineering and product stakeholders in ways that distribute security ownership rather than concentrate it in a team that’s perpetually outnumbered, and connecting signals across the organization that no individual agent can connect because they each only see part of the picture. Those are capabilities that require organizational relationships, accumulated context and judgment developed over time. They are also capabilities that most security programs have chronically underinvested in because the knowledge work was always more urgent.

What organizations should be doing now

The organizations that navigate this well won’t be the ones that respond after AI has absorbed the knowledge-work layer. They’ll be the ones building intuition-work capabilities — in their hiring criteria, their career development frameworks and their expectations for what a senior security engineer actually does — before the transition forces the issue.

This connects to a broader argument about security headcount that Crogl CEO Monzy Merza made in a recent episode of the same podcast: the work isn’t disappearing, it’s shifting. The security teams that treat AI as a headcount reduction tool will find themselves short of exactly the judgment and organizational relationships that the new model demands. The ones that treat it as a reallocation of human capacity toward higher-order work will be better positioned for what the profession is becoming.

Kulkarni’s framing of intuition work is a useful diagnostic. If the work a security engineer is doing today could, in principle, be handed to an AI agent and executed reliably, that work is on a clock. The question worth asking now — before the clock runs out — is what they will be doing instead, and whether the organization is building toward that or away from it.

Listen to the full conversation with Shan Kulkarni on the latest episode of the To the Point Cybersecurity Podcast.