💻 computer science

A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy

This paper proposes a novel, tiered framework for Human-AI collaboration in Security Operations Centers that dynamically maps five levels of AI autonomy to specific Human-in-the-Loop roles and trust thresholds, thereby enabling adaptive, explainable decision-making that enhances rather than replaces human oversight in cyber defense.

Original authors: Ahmad Mohsin, Helge Janicke, Ahmed Ibrahim, Iqbal H. Sarker, Seyit Camtepe

Published 2026-08-05

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Ahmad Mohsin, Helge Janicke, Ahmed Ibrahim, Iqbal H. Sarker, Seyit Camtepe

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling city where data flows like traffic and people live in digital houses. In this city, there are always troublemakers trying to break into homes, steal mail, or cause chaos. To keep everyone safe, we have special police stations called Security Operations Centers (SOCs). These aren't just rooms with computers; they are the command centers where teams of human detectives watch screens, analyze clues, and stop cyber-criminals before they can do real damage. But here's the problem: the city is getting bigger, and the bad guys are getting smarter, faster, and more sneaky. The police stations are drowning in a flood of alarms—thousands of them every single day. Most of these alarms are false, like a smoke detector going off because someone burned toast, but the detectives have to check every single one. This leads to "alert fatigue," where the humans get so tired and overwhelmed that they might miss the real fire.

To fix this, we've started bringing in robot helpers powered by Artificial Intelligence (AI). These robots can scan millions of clues in a split second, way faster than any human. But there's a catch: if we let the robots run the whole show, they might make mistakes we don't understand, or they might get tricked by clever hackers. If we don't let them help enough, we're back to being overwhelmed. So, the big question for scientists is: How do we build a perfect team-up where the human detectives and the AI robots trust each other, know exactly who is doing what, and work together without anyone getting burned out or making a huge mistake? This is the puzzle a team of researchers from Australia set out to solve.

The Paper's Big Idea: A Team-Up Guide for Humans and Robot Detectives

The paper you're reading, titled "A Unified Framework for Human–AI Collaboration in Security Operations Centers with Trusted Autonomy," is essentially a rulebook for building that perfect team. The authors, Ahmad Mohsin and his colleagues, argue that we can't just slap an AI onto a security system and hope for the best. Instead, they propose a structured way to mix human brains with robot speed, based on how much we trust the robot and how tricky the job is.

Think of it like teaching a new student driver. You wouldn't let them drive on a busy highway on their very first day (that would be too risky). You start them in an empty parking lot (Level 1: The AI helps, but the human holds the wheel). As they get better and you trust them more, you let them drive on quiet streets (Level 2: The AI does the driving, but the human watches closely). Finally, if they prove they are amazing and the road is safe, you might let them drive themselves while you just nap in the back seat (Level 4: The AI is fully in charge).

The paper suggests that security centers should use this same "leveling up" system. They created a framework with five levels of autonomy (how independent the AI is):

Level 0: The human does everything. The AI is just a tool, like a calculator.
Level 1: The AI suggests what to do, but the human must say "yes" before anything happens.
Level 2: The AI handles routine tasks automatically but asks for permission before doing anything important.
Level 3: The AI does most things on its own, and the human only steps in if something weird or dangerous happens.
Level 4: The AI runs the whole show for routine stuff, and the human only checks the reports later.

The key to this system is Trust. The paper explains that you can't just give the robot the keys immediately. Trust is built over time, like a friendship. If the AI makes good decisions and explains why it made them (so the human understands), the human trusts it more, and the AI gets to do more work. If the AI is a "black box" that doesn't explain itself, the human stays in control, and the robot does less.

The "Robot Avatar" Test Drive

To see if their idea actually works, the researchers didn't just write theory; they built a test. They created a simulated "cyber range," which is like a video game world designed to look exactly like a real company's computer network. In this game, they set up a team of human detectives and a special AI assistant they called CyberAlly. CyberAlly was a super-smart robot brain (based on a type of AI called a Large Language Model) that had been trained on two years of fake cyber-attacks and security data.

They ran a series of "wargames" where a team of hackers (the Red Team) tried to break into the system, and the human-AI team (the Blue Team) tried to stop them. The scenarios were realistic, involving things like hackers trying to mess with the sensors that control a ship's depth or trying to stop a train from delivering supplies.

Here is what happened in the simulation:

The AI helped filter the noise: At first, the AI acted like a Level 1 assistant. It looked at thousands of alerts and told the humans, "Hey, 70% of these are just false alarms, ignore them." This instantly made the humans' jobs easier.
The team got faster: When the hackers attacked, the AI helped the humans figure out what was going on much faster. In one test, the time it took to investigate a problem dropped from three hours to just one hour. That's a 67% improvement.
The response time skyrocketed: When it came time to stop the attack (like blocking a bad hacker or locking a door), the AI helped cut the time it took to fix the problem from 8 hours down to 90 minutes.
Trust grew naturally: At the start, the humans checked everything the AI said. But as the AI kept getting it right and explaining its reasoning clearly, the humans started trusting it more. They let the AI handle more routine tasks automatically, freeing them up to focus on the really hard, tricky problems.

What This Means for the Future

The paper suggests that this "Trusted Autonomy" framework is a winning way to handle the future of cybersecurity. It shows that we don't have to choose between "humans only" (which is too slow) and "robots only" (which is too risky). Instead, we can build a partnership where the robot handles the boring, fast, repetitive stuff, and the human handles the complex, scary, and important decisions.

The researchers found that by carefully matching the AI's independence to the human's trust level, security teams can stop getting burned out by false alarms and start catching real threats much faster. They proved this in their simulation, showing that alert fatigue went down and response times went up. However, they are careful to say this was a test in a fake environment. While the results look very promising, real-world security centers have messy, complicated systems that might be harder to fix than a video game.

In short, this paper gives us a blueprint for the future of cyber-police stations: a place where humans and AI are best friends, each doing what they are best at, working together to keep our digital city safe. It's not about replacing the human detective with a robot; it's about giving the detective a super-powered sidekick that never gets tired, never misses a clue, and always knows when to ask for backup.

Technical Summary: A Unified Framework for Human–AI Collaboration in Security Operations Centers with Trusted Autonomy

Problem Statement

Security Operations Centers (SOCs) face critical operational challenges driven by the increasing sophistication of cyber threats and the limitations of current automation strategies. Despite the integration of Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), and Endpoint Detection and Response (EDR) tools, SOCs struggle with alert fatigue, high false-positive rates (up to 99% in some studies), and analyst burnout. Existing frameworks often rely on static or binary autonomy settings (either fully manual or fully automated), failing to account for the varying complexity, criticality, and risk associated with different SOC tasks. Furthermore, current approaches frequently lack systematic structures to manage Human-in-the-Loop (HITL) decision-making, trust calibration, and scalable autonomy. This gap results in inefficient workflows where human analysts are overwhelmed by noise, while AI systems lack the necessary oversight for high-stakes, novel, or ambiguous incidents.

Methodology

The authors propose a Unified Human–AI Collaboration Framework grounded in a triadic relationship between Autonomy, Trust, and Human-in-the-Loop (HITL) involvement. The methodology involves three core components:

Theoretical Modeling of Autonomy and Trust:
- Autonomy ( $A$ ): Defined as a scalar value $A \in [0, 1]$ , modeled as a function of task complexity ( $C$ ), risk ( $R$ ), and trust ( $T$ ): $A = 1 - (\lambda_1 C + \lambda_2 R)(1 - T)$ . This equation posits that autonomy decreases with higher complexity and risk but increases with higher trust.
- HITL Involvement ( $H$ ): Defined as the inverse of autonomy ( $H = 1 - A$ ), ranging from full human control to full AI autonomy.
- Trust ( $T$ ): Modeled as a weighted sum of explainability ( $E$ ), performance history ( $P$ ), and uncertainty ( $U$ ): $T = \alpha_1 E + \alpha_2 P + \alpha_3(1 - U)$ .
Five-Level Autonomy Framework:
Inspired by the SAE J3016 standard for vehicle automation, the authors map SOC operations to five distinct autonomy levels (0–4), aligned with SOC analyst tiers (Tier 1–4) and NIST Cybersecurity Framework functions (Identify, Protect, Detect, Respond, Recover):
- Level 0 (Manual): No automation; analysts handle all tasks.
- Level 1 (AI-Assisted): AI provides decision support (e.g., alert scoring); humans retain full control.
- Level 2 (Semi-Autonomous): AI executes routine tasks but requires explicit human approval for critical actions.
- Level 3 (Conditionally Autonomous): AI executes defined tasks autonomously; humans supervise (Human-on-the-Loop) and intervene only for exceptions.
- Level 4 (Fully Autonomous): AI manages comprehensive functions with minimal human oversight (Human-out-of-the-Loop), focusing on governance and audit.
Situational Awareness (SA) Integration:
The framework incorporates SA as a central mediator, breaking it down into self-awareness (recognizing limitations), teammate awareness (understanding roles and cognitive states), and world awareness (maintaining a coherent view of the threat landscape). This ensures that AI insights are interpreted within human mental models.
Empirical Validation (Case Study):
The framework was validated using a simulated cyber range (ACDC Cyber Range) featuring a fine-tuned Large Language Model (LLM) agent named CyberAlly. CyberAlly, equipped with Retrieval-Augmented Generation (RAG) and knowledge graphs, operated within a Red Team vs. Blue Team exercise involving IT/OT environments (maritime port systems). The agent interacted with SIEM (Wazuh), SOAR, and analysts via a chat interface, progressing through autonomy levels based on incident complexity and established trust.

Key Contributions

Triadic Framework: The paper formalizes the interplay between Autonomy, Trust, and HITL, offering a structured approach to dynamic task allocation in SOCs.
Tiered Autonomy Scale: It introduces a granular, five-level autonomy model that moves beyond binary automation, allowing for adaptive delegation based on task risk and analyst trust.
Role Alignment: The framework maps specific SOC analyst tiers (Tier 1–4) to corresponding autonomy levels and HITL configurations, clarifying responsibilities from initial triage to strategic governance.
Operational Workflow Design: It details collaborative workflows for Alerts Management, Threat Management, and Response & Recovery, demonstrating how AI and humans can co-investigate and co-decide.
Empirical Evidence: Through the CyberAlly case study, the paper provides a practical demonstration of the framework's feasibility, showing how an LLM-based agent can reduce false positives and accelerate response times while maintaining human oversight.

Results

The case study involving the CyberAlly agent in the ACDC cyber range yielded the following quantitative and qualitative outcomes:

False Positive Reduction: The AI agent reduced false-positive alerts from 70% to 35%, significantly improving the signal-to-noise ratio.
Investigation Efficiency: Investigation times for complex incidents (e.g., credential misuse, OT manipulation) were reduced from 3 hours to 1 hour (a 67% improvement).
Response Time (MTTR): Mean Time to Respond was reduced from 8 hours to 90 minutes (an 80% reduction) in specific scenarios involving endpoint isolation and threat containment.
Automation Scale: Automated ticketing increased from 10% to 75% of total incidents.
Trust Calibration: The study demonstrated that trust is not static; it evolved as the AI provided explainable justifications and consistent performance, allowing for a gradual shift from Level 1 (Full HITL) to Level 2/3 (Human-on-the-Loop) autonomy.

Significance and Claims

The paper claims that its primary significance lies in providing a structured, scalable, and theoretically grounded approach to integrating AI into SOCs without replacing human expertise. By addressing the "black box" nature of AI and the rigidity of current automation, the framework enables Cognitive SOCs where AI acts as a dependable enhancement to human decision-making.

The authors assert that their framework:

Bridges the Gap: It connects theoretical models of autonomy and trust with practical implementation in SOC workflows.
Mitigates Risk: By calibrating autonomy based on trust and risk, it prevents automation bias and ensures accountability for critical decisions.
Enhances Resilience: It allows SOCs to scale operations and handle the volume of modern cyber threats while reducing analyst burnout and cognitive load.
Facilitates Evolution: The framework supports the transition from reactive, rule-based SOCs to proactive, adaptive, and learning-oriented security operations centers.

The paper concludes that while challenges regarding model drift, explainability, and organizational adoption remain, the proposed framework offers a viable pathway for designing next-generation SOC architectures that leverage AI for trusted autonomy.