An Automated Decision-Making System is software that makes or supports decisions by scoring, ranking, sorting, or filtering people or records. In practice, an ADS may flag an employee for review, prioritize a loan applicant, or recommend discipline based on patterns in data. The output is not always the final decision, but it can strongly shape it.
In cyber security, ADS matters because it creates high-stakes automation around identity, access, and personnel actions. A weak ADS can be manipulated with bad input data, biased features, or tampered records, turning flawed recommendations into real-world harm. Defenders need audit logs, access controls, and decision provenance so they can show what data was used, who reviewed the output, and whether a human could override it. Attackers may try to poison training data, hide evidence, or exploit “rubber-stamp” review processes where a person approves the machine result without checking it. Strong ADS governance makes automated decisions more transparent, testable, and resilient.