An attacker does not get tired. That is not a motivational line, it is the structural problem of this entire field.
Whoever is in your environment can dwell for months, move once a week, and wait. They are not carrying a ticket queue or a family or a body that needs seven hours a night. You are. And the standard industry answer to that asymmetry has been to ask humans to cover more of the gap: rotations, on-call, someone always reachable.
That answer has a ceiling, and we hit it a long time ago. You cannot out-vigil a machine. Every hour you spend trying is an hour of degraded judgment you will pay for later, and I have watched what the bill looks like.
So the question is not how to stay awake. It is what can legitimately hold the watch while you are not.
The tension I need to name first
I have written that agentic tooling in operations is dangerous, and I meant it. An automated recommendation nobody verified took down three services on my watch and cost most of a day. The fifth Iron Rule says automate the repetitive but keep humans in the loop for the decisions that matter.
Now I am arguing for letting agents run the night. Those look like they contradict each other. They do not, and the difference is the whole point of this post.
The failure mode I wrote about was an agent making a decision and a human providing a signature. What I am describing here is an agent doing work so that a human is in a fit state to decide. One replaces judgment. The other protects it.
Get that line wrong and you have built the thing I warned about. Get it right and you have bought back the only resource that actually makes the human worth waking.
What an agent should own overnight
The honest scope is narrower than the marketing, and it is still enormous.
Triage and noise reduction. Most of what fires overnight is not an incident. It is duplicates, known-benign patterns, and the same scheduled job tripping the same threshold it trips every night. An agent that collapses forty alerts into three real candidates has not made a single security decision. It has removed the work that was never worth waking anyone for.
Enrichment. By the time a human opens their eyes, the asset should already be identified, the account history pulled, the related events correlated, the relevant logs assembled, and the timeline drafted. That is hours of context-gathering that requires no judgment and that a tired person does badly.
Evidence preservation. Snapshot it, hash it, keep it. Nothing is worse than waking to a real incident and finding the volatile evidence aged out while everyone slept.
Tightly scoped containment. This is the only place an agent takes action, and it belongs to a specific category: reversible, small blast radius, and a scenario you have seen enough times to write down precisely. Isolating a single endpoint. Revoking one session. Blocking one hash. If you cannot describe the exact preconditions in a sentence, it is not a candidate.
The brief. The agent's real deliverable is not an action. It is a human waking to here is what happened, here is what I did, here is what I could not classify, and here is what I need you to decide.
What it must never own
Anything irreversible. Anything with a blast radius you would not accept being wrong about. Anything novel, meaning anything the agent could not confidently classify, because novelty is precisely the signal that a human is required.
And critically: anything where the right answer depends on business context the agent does not have. Whether that traffic pattern is an exfil or a migration nobody told security about is not a technical question. It is a question about your organization.
The rule I use is simple. If being wrong is expensive and undoing it is hard, a rested human decides in daylight. Everything else can wait in a queue with a good brief attached.
Why this is a physical argument
Here is where it closes the loop, and why this sits on a site about becoming unhackable rather than a vendor blog.
Sleep is not downtime. It is the recovery mechanism. It is where consolidation happens, where the stress response resets, where the tank refills. An operator who has been woken three nights running is not a well-rested operator minus some hours. They are a measurably worse decision-maker who feels fine, because fatigue does not present as impairment from the inside. It presents as confidence.
So every unnecessary 3am wake-up has a cost that does not appear on any dashboard: it is paid the next day, in narrower thinking and earlier commitment to the first plausible answer.
Which means an agent that reliably prevents a needless wake-up is not a convenience. It is a security control, and it is protecting the component that catches the things automation cannot: the novel attack, the pattern that does not match anything, the thing that is only visible to somebody who knows what normal feels like here.
That is the trade. You give the machine the tireless work so the human keeps the capacity for the work that requires being human.
The loop that keeps you sharp
The obvious objection is the one I have made myself: if the agent handles the night, does the operator get worse?
Yes, if you let it. That is not a reason to skip the automation. It is a reason to build the loop that prevents it.
Every autonomous action gets reviewed by a person in daylight. Not audited quarterly. Reviewed the next morning, by someone who has to say whether it was right. That does three things at once: it catches the agent's mistakes while they are cheap, it keeps the human's pattern library current, and it makes the overnight decisions legible instead of invisible.
Measure two numbers, not one. How many nights nobody had to wake. And when someone did, how fast they could orient. The second one is the health check on your humans. If it is getting worse over time, your agents are not augmenting anyone. They are eroding them, and you have built the failure I wrote about.
Why the effort has to continue
Because the asymmetry is not going away, and it is getting worse. The other side is automating too, and they are not constrained by change control or a review board.
A defense built on human vigilance alone loses slowly, through attrition, as good people burn out and leave and take their pattern recognition with them. A defense built on automation alone loses suddenly, the first time something novel arrives that nobody wrote a rule for.
The only version that holds is both, each doing what it is actually good at. Machines are tireless and literal. Humans are contextual and adaptive and require sleep. Building a system where each covers the other's weakness is not a compromise. It is the only design that survives contact.
The enemy does not sleep. You have to.
So build the thing that lets you.