Framework Proposes Tiered AI Autonomy for Security Operations Centers to Enhance Human Decision-Making

Security Operations Centers face a mounting challenge: how to effectively integrate AI assistance without either overwhelming human analysts with alerts or ceding critical decisions to automation. A new research framework addresses this problem by formalizing the relationship between AI autonomy, trust calibration, and human involvement in SOC workflows.

The Problem with Current SOC Systems#

Most existing SOC frameworks focus heavily on automation, treating autonomy as a binary on-off switch rather than a spectrum tailored to task complexity. This approach fails to account for the fact that different threats, alert types, and operational scenarios carry vastly different levels of risk and require different levels of human judgment. The result: alert fatigue for analysts and fragmented decision-making workflows.

A Tiered Autonomy Model#

The proposed framework maps five levels of AI autonomy—from fully manual to completely autonomous—onto specific Human-in-the-Loop roles and trust thresholds customized for each task. Rather than applying uniform automation across all SOC functions, the system adapts to operational context. Core functions like monitoring, threat detection, alert triage, and incident response each receive autonomy settings matched to their inherent complexity and risk profile.

The AI-Avatar Case Study#

The framework is tested through a simulated cyber range environment featuring an LLM-based SOC assistant called the cybersecurity AI-Avatar. In this proof-of-concept, the AI tool reduces alert fatigue by intelligently filtering and prioritizing notifications, while strategically escalating ambiguous or high-stakes decisions to human operators. The result demonstrates that AI can coordinate response activities more smoothly while maintaining meaningful human oversight.

Why It Matters#

This approach represents a shift from viewing AI in SOCs as a replacement for human expertise to positioning it as a complement. By connecting autonomy levels to explicit trust metrics and human roles, the framework enables SOCs to scale AI assistance responsibly—boosting analyst productivity while preserving the judgment that critical security decisions demand.