Next Generation Cybersecurity – Guiding Human-AI Collaborative Intelligence & Work Transformation in Security Operations Centre (SOC) – eSentire – U. Waterloo

Our research focuses on the critical intersection of artificial intelligence and cybersecurity operations, specifically examining how AI tools can be effectively integrated into Security Operations Centre (SOC) workflows. As cyber threats become increasingly complex, we investigate the delicate balance between leveraging AI automation and maintaining human expertise in threat detection and response.

Using Cognitive Task Analysis (CTA) as our primary methodological framework, we study how SOC operators process information and make decisions during security incidents. Our work addresses key challenges in human-AI collaboration, including automation bias, skill degradation, and the risk of reduced situational awareness that can occur when operators over-rely on automated systems.

We advocate for adaptive automation approaches where control dynamically shifts between human operators and AI agents based on task demands and context. This research is particularly relevant given recent advances in large language models for cybersecurity applications and growing concerns about operator burnout in high-stress SOC environments.

Our goal is to develop evidence-based guidelines for implementing AI support systems that enhance rather than replace human judgment, ensuring that technological advancement strengthens cybersecurity operations while preserving the critical thinking skills that human operators bring to complex threat scenarios.

Faculty Supervisor:

Daniel Smilek

Student:

Partner:

eSentire

Discipline:

Sociology

Sector:

Information and cultural industries; Professional, scientific and technical services

University:

University of Waterloo

Program: