Managing Al-Enabled Automation in Security Operations Centres: A Task- and Risk-Based Framework for Work Allocation and Decision Quality

Abstract

Security Operations Centres (SOCs) are under sustained pressure from growing alert volumes, fragmented toolsets, false positives, 24/7 coverage requirements, and persistent workforce constraints. These pressures create a management problem that is not simply technical: organisations must decide how to use artificial intelligence (AI) in security operations without weakening accountability, trust, or decision quality. While recent advances in generative and agentic AI create opportunities to accelerate triage, enrichment, correlation, and selected response-support activities, they also introduce new risks. Faster execution may reduce operational delays, but it can also create rework, unsafe containment, automation bias, or misplaced confidence when AI is applied to ambiguous or high-consequence situations. This thesis develops a task- and risk-based management framework for allocating AI-enabled automation within SOC workflows. Rather than treating AI adoption as a general solution to SOC pressure, the study asks where AI should lead, where it should support, where human–AI co-execution is appropriate, and where human-only judgement should remain decisive. The research is positioned as a management and operating-model problem, not as a technical implementation or vendor benchmarking exercise. The framework is built around two linked artefacts. The first is the AI Automation Fit Score (AAFS), a structured scoring model that evaluates automation suitability through repeatability, time leverage, ambiguity, and execution risk. The second is the Work Allocation Matrix (WAM), which translates those scoring judgements into execution modes across SOC task segments and incident archetypes. Together, these artefacts provide a practical way to compare where AI-enabled automation is likely to create operational value and where it requires stronger governance or restriction. The findings indicate that AI-enabled automation is most suitable for structured, high-volume, and low-ambiguity work such as machine-generated triage, prioritisation, and enrichment. Human–AI co-execution is more appropriate where correlation, scoping, and investigation require interpretation but still benefit from AI-supported analysis. Human-led or human-only control remains necessary where incidents involve high ambiguity, legal or HR sensitivity, critical containment decisions, or the integrity of AI systems themselves. The thesis also argues that decision quality must be treated as a co-equal management objective alongside speed. Mean time to resolution (MTTR) remains important, but it is only one part of a broader allocation decision that must also account for risk, reversibility, accountability, and Quality Penalty Time. The contribution of this thesis is therefore a management framework for the responsible allocation of AI-enabled automation in SOC operations. It supports leaders in moving beyond broad claims about AI efficiency toward a more disciplined question: which work should be automated, under which conditions, with which controls, and with which limits on autonomy. Although grounded in the SOC context, the framework may also offer a basis for future exploration of work-allocation logic in other high-volume, information-intensive decision environments.