← All AI Engineer talks

AI Engineer Summit 2025

Where AI is superhuman: The right jobs to automate with LLMs

Andy Triedman· Partner, Theory Ventures11:53

Read the talk

Where AI becomes superhuman: automating work constrained by scale

The strongest automation opportunities often arise where people already rely on rules to handle overwhelming volume, from security alerts to customer messaging.

From a talk by Andy Triedman

Which jobs actually suit automation?

You can ask an LLM to act as a personal trainer, a primary care doctor, or an editor, and it will attempt all three. Andy Triedman, a partner at Theory Ventures, describes using assistants in each of those roles. Businesses face the same abundance of possible applications across sales, customer service, security, finance, and engineering. But willingness to attempt a task does not tell a founder where to build or an executive where to invest. The nature of the work determines the opportunity.

Slide asking, “You can try applying AI to any job... but where does it actually make sense?” with the presenter inset at upper right.
Where does applying AI to a job actually make sense?

Theory approaches that selection problem as an early-stage investor in data and machine learning infrastructure and applications. Based in San Francisco, the firm conducts thematic research, including conversations with hundreds of buyers and builders across job categories. The useful unit of that research is a workflow: what information comes in, what decisions must happen, and what prevents the work from getting done today.

0:000:14
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

0:00 · section reference included

Transformation, synthesis, and reasoning

Triedman starts with an account of LLMs as models of the distribution of their training data. For workflow automation, three capabilities emerge from that foundation. The first is transformation: converting a PDF into a spreadsheet, a spreadsheet into an email, or an email into JSON. Historically, integrating and transforming information has blocked many automation projects. Triedman sees LLMs as effectively solving that bottleneck by making information usable across formats.

An email-to-JSON task makes that boundary concrete. For an illustrative email reading “Please send the replacement to 14 Oak Street; order A123,” the useful output is a record that another system can consume:

json

{
  "order_id": "A123",
  "request": "replacement",
  "shipping_address": "14 Oak Street"
}

The transformation extracts the request; it does not decide whether the replacement should be approved. That distinction separates moving information into a usable form from making a business decision.

The second capability is synthesis: reducing a large body of information into a summary or an answer. Theory uses deep research platforms from Gemini and OpenAI to synthesize hundreds of websites when investigating a technology or market.

The third is reasoning, where the availability of training data becomes especially consequential. Written reasoning leaves out much of what people know: assumptions, organizational context, and intermediate judgments that nobody records. Models have substantial material to learn from in common sense, Stack Overflow, support forums, and increasingly code, mathematics, and logic that can be generated programmatically. The reasoning of a security analyst, lawyer, or accountant handling a complex case is less readily available. Capturing that domain knowledge can therefore become a differentiator for a company building automation, rather than something it can assume the base model already possesses.

1:071:19
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

1:07 · section reference included

Break the job into tasks

A job title is too broad to specify an automation. Security analysis becomes more tractable when it is decomposed into an iterative procedure:

  1. Receive an alert.
  2. Run a query or research the event to collect more information.
  3. Transform or synthesize the result.
  4. Analyze the available evidence.
  5. Return to research if necessary, continuing until there is enough information for a determination.

The loop matters: an investigation is not necessarily one retrieval followed by one answer. Its next information request depends on what the analyst has already learned.

Security analysis flowchart linking an alert to research, synthesis or transformation, analysis of existing information, and a final determination, with an arrow returning from analysis to research.
Breaking security analysis into tasks and an iterative research loop.

Even the query step contains smaller tasks: choose a tool, write a query, and debug errors. Those subtasks may belong to different people or to automated systems configured by people. Conversely, a person's role includes more than the investigation itself. Meetings, coordination, and interpersonal responsibilities remain part of the job even when its core task can be automated. Task coverage and role replacement are different questions.

2:402:51
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

2:40 · section reference included

Match the system to volume and complexity

Work differs along two useful dimensions: how many tasks arrive and how complex each task is.

WorkTypical constraint
Strategic planningThinking and coordination around a few complex decisions
Customer supportRepeated cases requiring customer reasoning and internal queries
CRM prospect queues or SIEM alertsLarge volumes of relatively simple tasks
Supply-chain messagingHundreds of repetitive emails or messages

A SIEM is a security information and event management system; a CRM manages customer relationships. In both, the task queue makes the volume problem visible.

Different positions on that spectrum call for different operating models:

  • Copilots for complex work. Humans remain in control and delegate selected tasks. Better models do not automatically acquire the unwritten context, priorities, and reasoning behind strategic decisions.
  • Core workflow automation. The system drives substantial or complete workflows, while experts configure its behavior and people review individual outputs or handle escalations.

Across the areas Theory has researched, Triedman estimates that many jobs could have 40–70% of their day-to-day work automated. This is an estimate about portions of work, not evidence that the corresponding roles disappear. The more radical opportunity lies farther along the spectrum, where volume itself dominates the job.

3:303:46
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

3:30 · section reference included

When the competitor is rules-based software

High-volume, relatively simple work is often difficult because there is too much of it. Once a team is overwhelmed, people stop handling every case individually. They write rules and build workflows to process the excess. The practical competitor for AI is then the existing rules-based system, rather than a human giving every case full attention.

Triedman contrasts a perception of LLMs as 80–90% as reliable as humans with a potential 10× advantage in work constrained by volume. This is a conditional scale argument, not a measured benchmark: the system must first be capable of the task, after which repeating it 10, 100, or 1,000 times a day becomes the source of advantage. His two examples—security investigations and customer engagement—come from Theory's portfolio.

5:135:25
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

5:13 · section reference included

Dropzone AI: investigating the alerts people cannot reach

As a company buys more security products, those products generate more alerts. Someone must investigate whether each alert represents a real threat requiring remediation or a false positive. Dropzone AI addresses the resulting investigation backlog. Triedman says analysts might inspect only 1% of alerts and use rules to filter the remainder. Rules handle simple cases, but the number of workflows to maintain grows as the team tries to cover more edge cases.

Repetition also creates a staffing problem. Triedman reports that analysts typically leave the role after 12–18 months. He also cites a shortage of about four million; the matching ISC2 workforce estimate concerns the global cybersecurity profession's gap between staffing and perceived need, rather than four million unfilled analyst positions.

Dropzone's agentic systems perform end-to-end investigations. Triedman characterizes their strengths as expertise across query languages, typo avoidance, and near-perfect memory. Those are claims about the system's advantages, not an error-free guarantee; his companion account acknowledges hallucinations and describes typo reduction probabilistically. The more consequential point is coverage: humans already lack time to investigate the full queue, so matching an ideal analyst on every dimension is not the threshold for improving the existing workflow.

Triedman describes Dropzone as providing investigation coverage 24 hours a day, 365 days a year. He also describes shared learning across customers: when a new threat appears, the network can make that knowledge available so other customers can identify and block it. The claimed advantage combines continuous investigation with reuse of discoveries beyond the customer where they first occurred.

6:026:18
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

6:02 · section reference included

Aampe: learning what to send each customer

Customer engagement has a similar scaling problem. Apps, subscription services, and retailers reach users through texts, notifications, and in-app personalization. Choosing a message for one person may be straightforward; choosing for a million people is not. Marketing teams therefore construct rules-based journeys, such as a sequence for new users or a reminder for someone who abandoned a cart. Aampe is Theory's example of automating this work.

Those journeys become difficult to maintain because users differ across several dimensions at once: interests, preferred messaging style, channel, and time of day. A team can manage a few cohorts, but writing branches for all combinations creates a combinatorial explosion. Measurement adds another limitation. A click is easy to associate with a message; a purchase a week later or subscription retention a month later is harder to connect to the strategy that influenced it.

Aampe changes the marketer's role from journey designer to experimentalist. Marketers create hundreds of variants, while agents explore what to send, to whom, when, and through which channel. The system evaluates effects across users' subsequent activities. The accompanying investment account describes reinforcement learning for this experimentation; the mechanism should not be understood as an LLM simply generating each personalization decision.

Aampe slide showing a branching journey interface on the left, a large right-pointing arrow, and an “AI Agentic Market Formation” diagram on the right.
Aampe contrasts a branching customer journey with an agentic system diagram.

Triedman reports substantial improvements in satisfaction, engagement, transactional outcomes, and retention, without providing numerical results or experiment details. His explanation is individual personalization: a person's experience need not be determined by membership in a large shared bucket.

Continuous experiments can also reveal customer groups the business did not know existed. Triedman describes a food-delivery customer discovering users who responded only to messages at 11 p.m. or midnight—later than the company would ordinarily contact them. These late-night snackers were not a cohort the marketing team had specified in advance. Their behavior emerged through experimentation, producing knowledge that data science and product teams could use beyond the messaging campaign itself.

7:217:37
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

7:21 · section reference included

From doing tasks to operating systems

Automating a workflow changes the surrounding team, not just the person who previously performed a task. Triedman identifies three directions for the remaining work:

  • Review outputs. Approve actions and handle cases escalated by the system.
  • Maintain the automation. Update workflows, model instructions, and data systems to improve performance and reliability.
  • Do higher-order work. Spend time on strategy and other responsibilities previously displaced by daily operations.

All three require experience in the domain. Knowing how to review an investigation or improve its instructions depends on understanding the work being automated.

That requirement conflicts with the staffing shape of many high-volume functions. Today, a large base of junior individual contributors executes daily tasks beneath a smaller group of experienced staff. Theory forecasts that substantial automation will make these organizations smaller and shift the remaining positions toward advanced or managerial work. The resulting structure could resemble a diamond or an inverted pyramid. These are forecasts about organizational change, not reported staffing outcomes.

Slide with a Roles column pointing from “Doing tasks” to reviewing LLM outputs, maintaining LLM systems, and strategic work; a Team structure column points from an upright triangle to a diamond and an inverted triangle.
Roles shift toward reviewing outputs, maintaining LLM systems, and strategic work as team structures change.

The difficult consequence is the training path. If fewer entry-level roles remain, how does an organization hire and develop the people who will eventually possess the expertise needed to review and maintain its systems? Automating the tasks that teach a profession can remove part of the route into that profession. Triedman leaves that as an open organizational challenge.

9:339:43
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

9:33 · section reference included

Technical suitability is only part of the business

Task decomposition reveals what a model must do; volume and complexity reveal where doing it repeatedly could change the economics of the work. The surrounding organization then determines how that capability can be adopted, supervised, and maintained. Those questions matter both to founders selling automation and to executives buying it.

But technology–problem fit is not business viability. A system can be well suited to a workflow without supporting a good business. Triedman's final qualification is to examine the severity of the pain, alignment of incentives, market size, and market structure as well. Being able to automate the work establishes a capability; it does not by itself establish who will pay, why they will adopt it, or whether a durable company can be built around it.

11:0011:15
Suggest correction

This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.

11:00 · section reference included

Resources

From the talk

Read the complete timestamped transcript
  1. 0:00

    Hi, I'm Andy Triedman, partner at Theory Ventures, and today I'll be sharing our research on AI automation in the workplace. This is how we evaluate the best places for new startups to build and the best places for executives to invest.

  2. 0:14

    You can ask an LLM to do pretty much any job, and it'll give it a shot. Personally, I use AI assistants as my personal trainer, as my primary care doctor, and my editor, to name a few.

  3. 0:24

    And for businesses, we think it'll be the same. AI will support sales teams, customer teams, security, finance, engineering, and more. But all jobs are not made equal. The nature of different work means that LLMs will be much more disruptive in some areas compared to others.

  4. 0:37

    So if you're a founder deciding what area to build in or an executive deciding which function to invest in, what should you do?

  5. 0:45

    Some quick context on Theory Ventures. We're based in San Francisco, and we invest in early-stage companies building on new innovations in data and machine learning, both in infrastructure and in application layer.

  6. 0:55

    We are very thematic and thesis-oriented investors. We spend most of our time doing deep research in areas like workflow automation, and we've talked to hundreds of buyers and builders across different job categories.

  7. 1:07

    So first, let's think about what LLMs are good at. All an LLM's trained to do is to model the distribution of the data that it's trained on. That creates three key emergent properties that really matter for workflow automation.

  8. 1:19

    The first is transformation. This is effectively taking information and converting it from one format to another, could be from a PDF to a spreadsheet, from a spreadsheet to an email, or from an email to JSON.

  9. 1:30

    Integrating and transforming data has historically been the largest blocker for most workflow automation, and LLMs effectively solve this problem, so they're really powerful.

  10. 1:40

    Second is synthesis. This is taking a lot of information and distilling it down or answering a question. For example, at Theory, we frequently use g-- deep research platforms from Gemini and OpenAI, which can summarize hundreds of websites to answer a question we have about some technology or market.

  11. 1:54

    And last but not least is reasoning. LLMs are pretty good at approximating human reasoning and decision-making. It's important to note that well-- when an LLM is reasoning, it's just modeling the distribution of written reasoning data, and one big challenge is that we as humans, we usually don't write down our reasoning or all of the assumptions behind it.

  12. 2:12

    So LLMs are really good at reasoning about what exists in training data. That can include basic common sense, stuff that's on Stack Overflow or other support forums, and increasingly lots of code and math and logic, which can be programmatically generated at large scale.

  13. 2:27

    Domain-specific reasoning, like how a security analyst or a lawyer or an accountant might think through a complex case, will take more bespoke data collection, which we think is actually a great differentiating advantage for new companies.

  14. 2:40

    And now, like, what does it mean to do a job? Thinking about automation, you need to get really specific, and when we research a new space, we break down the workflows to a task or a sub-task level.

  15. 2:51

    So here's an example in security operations. An analyst might get an alert, run a query, or do some research to get more information, transform or synthesize that result, analyze it, and then continue to iterate on those steps until they've reached a conclusion.

  16. 3:04

    You could even break this down further, like within the querying step, they might choose a tool, then write a query, then debug errors. A couple notes. One, a job is not necessarily a single person.

  17. 3:14

    Could be done by multiple people throughout the team, or it could be done by automated systems set up by people. Um, we'll talk more about that later in the presentation.

  18. 3:22

    And second, a person's job isn't just the core task they work on. They're all of the interpersonal stuff, joining meetings, et cetera, which are really important in the context of an organization.

  19. 3:30

    We'll also talk more about that later. So where do LLMs add the most value? We see jobs generally existing on a spectrum of volume and complexity. There are very complex, low-volume jobs like strategic planning, where people spend most of their time just thinking and coordinating with others.

  20. 3:46

    There are jobs in the middle, like customer support, who handle a number of cases that are generally pretty straightforward, but might include reasoning with the customer, querying internal systems, et cetera.

  21. 3:55

    And then there are jobs who have massive amounts of relatively simple tasks. Usually, these are jobs where the primary interface is a task queue, like a list of prospects in a CRM or a list of security alerts in a SIEM.

  22. 4:07

    Or they're ones where people are sending hundreds of repetitive emails or messages all the time, like in supply chain operations.

  23. 4:14

    LLMs will impact all of these jobs, but differently. On the more complex side, we expect these systems will be mostly implemented as co-pilots. Even as the models improve, doing these jobs requires so much context, reasoning, and priorities, some written, but most unwritten.

  24. 4:28

    And so for the foreseeable future, we imagine that these workflows will still be driven mostly by humans, who then delegate or accelerate some tasks with LLMs. In the middle is core workflow automation.

  25. 4:39

    This is where we think LLMs can automate substantial or end-to-end workflows, where humans are no longer in the driver's seat. But they require more complex configuration with expert knowledge, and humans will still be helping out on a task-by-task basis, either as a reviewer or someone to escalate to, et cetera.

  26. 4:55

    This is a really great category for AI automation. Across different areas we've researched, we see a lot of jobs where 40 to 70% of day-to-day work can be automated.

  27. 5:03

    But today, we're gonna focus on this category at the top, where LLMs disrupt the job entirely. We're really excited about this area, so let's dig into what it means.

  28. 5:13

    High volume, relatively low complexity jobs will be the most transformed by LLMs because that's where they're already superhuman. These are jobs that are hard because of scale. Teams just get overwhelmed by the volume.

  29. 5:25

    And so in many cases, there's just too many things to handle, and so they build rules-based automations and workflows to do it for them. And that's really awesome for people building with AI because now your competition is no longer AI versus human, it's AI versus previous generation of rules-based software.

  30. 5:40

    And in many jobs where people think of LLM systems as being 80, 90% as reliable as a human, in these kind of jobs, an LLM system can be 10 times better than a human ever could be because as long as they can do the task in the first place, there's no difference for them doing it 10 or

  31. 5:55

    100 or 1,000 times each day. I'll give two examples now from different companies in the Theory portfolio.

  32. 6:02

    The first is Dropzone AI in the security oper- operation space. As companies grow, they buy more security products, each of which generates more alerts, and as the number of alerts grow, the companies then need teams to monitor them and investigate if they're real, to perform a remediation, or if they're a false positive.

  33. 6:18

    The problem is that there are just way too many alerts, and so security analysts might only look at 1% and then build rules-based systems to get rid of the rest.

  34. 6:26

    You can see an example on the left-hand side. Um, it works well for simple stuff, but all of the rules and workflows you need to maintain would really explode as you consider all of the edge cases.

  35. 6:37

    And then from an analyst perspective, this is eye-bleedingly repetitive work. They typically leave the role after 12 to 18 months, and there's a shortage of about four million analysts globally.

  36. 6:46

    Dropzone has built agentic systems that perform end-to-end investigations just like a human. In many ways, they're better than a typical human analyst. They're experts in every query language. They don't make typos.

  37. 6:58

    They have near-perfect memory. But the key thing is they don't even need to be, because humans don't even have time to look through all these alerts.

  38. 7:06

    They just need to be better than the rules-based systems, which is pretty easy. They then provide 24/7, 365 coverage, unlike a human analyst. And last but not least, they can share learnings across customers, so if there's a new kind of threat that comes in, all of the customers in the network can e- immediately be able to identify

  39. 7:21

    and block it. Another example is in customer engagement, like our portfolio company, AMP. Any app, subscription service, or retail business wants to engage with its customers, whether by text, notifications, or through in-app personalization.

  40. 7:37

    And deciding what to send one user isn't that hard, but deciding what to send a million users really is. So to handle the volume, marketing teams set up and manage different rules-based journeys.

  41. 7:47

    "Here's a sequence we'll send to new users. This is what we'll push to a customer who left something in their cart." There's an example of this interface on the left-hand side.

  42. 7:55

    But we know here that everyone has different preferences. They might have different interests. They might respond to different types of messaging. Maybe they prefer different channels, different times of the day.

  43. 8:05

    And today, marketing teams might be able to manage a few cohorts of customers, but designing the rules-based journeys across all of these variables would create a combinatorial explosion that would just be impossible for anyone to manage.

  44. 8:17

    And they're also forced to evaluate the impact on a single metric, like message clicks, but they have no way to determine how a strategy might drive customer purchases a week later or subscription retention a month down the line.

  45. 8:29

    AMP, on the right-hand side, has built agentic automation that explores what messaging to send to whom, when, and how. Marketing teams turn more into experimentalists, where they craft hundreds of different variants and then let the AI system figure out how to distribute them and evaluate the impact on all of the users' activities over time.

  46. 8:46

    They show massive uplift in customer satisfaction and engagement metrics, whether transactional or retention-based, which makes sense because they're one-to-one personalized for each user versus bucketing that user along with 10 or 100,000 others.

  47. 9:01

    But even more than that, because the agents are constantly running experiments of what to show to whom, they help these companies discover brand-new cohorts and insights on their customers.

  48. 9:10

    Uh, one of their customers is a food delivery company, and they found a bunch of users who were only responding to 11:00 PM or midnight messages, which is later than they would ever typically message a customer, because they were this new cohort of late-night snackers that the company previously didn't know about.

  49. 9:24

    That's a strategic asset that can be used by data science and product teams, and another example of the unique capabilities of agentic systems at scale.

  50. 9:33

    So what does this mean for organizations? Obviously, people don't do their work on an island. They work with a team. And how will AI change how those teams work together?

  51. 9:43

    We think about it at two levels. First, on the role level, work shifts from completing tasks to reviewing the LLM outputs, whether as an approval workflow or escalation ones, to maintaining these LLM systems, maybe updating workflows, model instructions, data systems to improve the overall performance and reliability, and last, doing higher order work that previously took a back

  52. 10:05

    seat to day-to-day operations, like in strategy. Of course, all of this work is higher level. Reviewing, maintaining systems, strategy all require expertise and experience in the role. But today, most functions doing this high-volume work are pyramid shaped.

  53. 10:19

    The largest groups of employees are the junior level ICs who are completing the day-to-day tasks. So when an LLM system automates a substantial portion of this work, we expect these organizations will need to, one, shrink because fewer employees are needed overall, most of the work is automated, and second, to invert, that the positions that do remain will

  54. 10:37

    be more managerial or advanced. So organizations will instead look like inverted pyramids or diamonds. This causes a lot of questions and challenges for businesses which are today oriented around this pyramid structure.

  55. 10:49

    For example, how do you hire and train new employees if there aren't a lot of entry-level roles? So it'll be an interesting type of challenge where we're looking to see how organizations respond over time.

  56. 11:00

    As a recap, when you're thinking about AI automating workflows, you need to break jobs down to their fundamental tasks, um, understand that jobs exist on a spectrum of complexity and volume, and that AI will be most disruptive in high-volume, low-complexity tasks.

  57. 11:15

    And last but not least, surrounding context will determine how AI impacts teams and organizations, which is important both for founders looking to sell to these organizations and executives looking to think about how these will be transformed by AI.

  58. 11:27

    One last note for founders. Um, here we're exploring sort of technology problem fit, how well LLM systems can do different jobs. There are a whole variety of other factors that determine if an idea is good to build a business around, like the severity of the pain point, the incentive alignment, the market size and structure, et cetera.

  59. 11:43

    Happy to chat more about that if anyone's thinking about building an AI workflow automation.

  60. 11:48

    Thanks so much for taking the time. You can reach me at this email here. Have a nice day.