Human-Centered AI and Decision Support in Security Operations Centers

Abstract

The growing complexity of cyber threats has made Security Operations Centers (SOCs) essential for real-time threat detection, incident response, and infrastructure protection. However, traditional black-box AI models often reduce trust and transparency in cybersecurity decisions. This chapter explores human-centered Explainable Artificial Intelligence (XAI) for improving interpretable threat detection, anomaly analysis, risk prioritization, and analyst decision-making. It also presents an AIoT-based “Explainable Intelligent SOC Monitoring System for Smart Enterprise Networks” integrating IoT network sensors, edge devices, AI intrusion detection, SHAP and LIME explainability, federated learning, and adaptive alert prioritization. A real-time SOC dashboard provides attack explanations, threat scores, and response support. Human–AI collaboration, analyst feedback, fairness, bias mitigation, trust, accountability, and regulatory concerns are also discussed to support more transparent, reliable, and trustworthy cyber defense systems.