{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T04:33:00Z","timestamp":1787027580096,"version":"build-2736575974"},"reference-count":26,"publisher":"MDPI AG","issue":"13","license":[{"start":{"date-parts":[[2026,6,29]],"date-time":"2026-06-29T00:00:00Z","timestamp":1782691200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"South-West University \u201cNeofit Rilski\u201d","award":["KP-06-N100\/7\/10.12.2025"],"award-info":[{"award-number":["KP-06-N100\/7\/10.12.2025"]}]},{"award":["KP-06-N100\/7\/10.12.2025"],"award-info":[{"award-number":["KP-06-N100\/7\/10.12.2025"]}],"id":[{"id":"https:\/\/ror.org\/002wcjr61","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Applied Sciences"],"abstract":"<jats:p>The increasing adoption of cloud computing has expanded organizational attack surfaces and created additional opportunities for identity abuse, ransomware operations, data exposure, and configuration-related security incidents. Conventional monitoring environments based primarily on static rules, fragmented telemetry, and manual triage often struggle to prioritize high-severity incidents in real time. This study evaluates the operational impact of an integrated AI-augmented cloud-native SIEM\/XDR\/SOAR architecture for cloud threat detection and automated incident response. A sequential mixed-methods comparative case study was conducted across two enterprise-style security environments: an AI-augmented architecture combining cloud-native SIEM, XDR telemetry unification, behavioral analytics, AI-assisted correlation, generative-AI analyst support, and SOAR automation, and a conventional baseline environment based on manual triage and signature-based controls. Three attack scenarios were analyzed: phishing-led account takeover, multi-stage ransomware, and shadow-IT data exfiltration. The AI-augmented architecture reduced mean time to triage from 17.4 h in the conventional baseline to 10.7 min and enabled ransomware containment in under five minutes through pre-configured automated response playbooks. The results also showed improved prioritization of high-severity incidents, reduced analyst review burden, and a high automated closure rate. The findings provide operational evidence for the evaluated security architecture. Limitations include single-vendor dependency, non-equivalent false-positive classification mechanisms, proprietary model internals, calibration requirements, and detection gaps involving legitimate third-party services and password-protected content.<\/jats:p>","DOI":"10.3390\/app16136454","type":"journal-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T02:11:57Z","timestamp":1782785517000},"page":"6454","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["AI-Driven Threat Detection and Automated Incident Response for Securing Cloud Workloads"],"prefix":"10.3390","volume":"16","author":[{"given":"Anton","family":"Chagovec","sequence":"first","affiliation":[{"name":"Department of Computer Science, Varna Free University \u201cChernorizets Hrabar\u201d, 84 Yanko Slavchev Street, Chaika Resort, 9007 Varna, Bulgaria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3658-7400","authenticated-orcid":false,"given":"Teodora","family":"Bakardjieva","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Varna Free University \u201cChernorizets Hrabar\u201d, 84 Yanko Slavchev Street, Chaika Resort, 9007 Varna, Bulgaria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8207-9976","authenticated-orcid":false,"given":"Antonina","family":"Ivanova","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Varna Free University \u201cChernorizets Hrabar\u201d, 84 Yanko Slavchev Street, Chaika Resort, 9007 Varna, Bulgaria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5533-322X","authenticated-orcid":false,"given":"Fatima","family":"Sapundzhi","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Varna Free University \u201cChernorizets Hrabar\u201d, 84 Yanko Slavchev Street, Chaika Resort, 9007 Varna, Bulgaria"},{"name":"Department of Communication and Computer Engineering, South-West University \u201cNeofit Rilski\u201d, 66 Ivan Mihailov Street, 2700 Blagoevgrad, Bulgaria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4614-2816","authenticated-orcid":false,"given":"Veselina","family":"Spasova","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Varna Free University \u201cChernorizets Hrabar\u201d, 84 Yanko Slavchev Street, Chaika Resort, 9007 Varna, Bulgaria"},{"name":"Department of Informational and Communication Technology, Faculty of Engineering, Nikola Vaptsarov Naval Academy, 73 Vasil Drumev, 9002 Varna, Bulgaria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3072-3739","authenticated-orcid":false,"given":"Andriana","family":"Ivanova","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Varna Free University \u201cChernorizets Hrabar\u201d, 84 Yanko Slavchev Street, Chaika Resort, 9007 Varna, Bulgaria"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,6,29]]},"reference":[{"key":"ref_1","unstructured":"Gartner (2026, May 10). Gartner Forecasts Worldwide Public Cloud End-User Spending to Total $723 Billion in 2025. Available online: https:\/\/www.gartner.com\/en\/newsroom\/press-releases\/2024-11-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-total-723-billion-dollars-in-2025."},{"key":"ref_2","unstructured":"SentinelOne (2026, May 10). Cloud Security Statistics 2024. Available online: https:\/\/www.sentinelone.com\/cybersecurity-101\/cloud-security\/cloud-security-statistics\/."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"224","DOI":"10.1145\/3723158","article-title":"Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities","volume":"57","author":"Tariq","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"233","DOI":"10.9734\/ajrcos\/2026\/v19i1816","article-title":"Advancing Cyber Threat Detection through SIEM-Based Automation and MITRE ATT&CK Aligned Analytics: A Systematic Review","volume":"19","author":"Mgbemele","year":"2026","journal-title":"Asian J. Res. Comput. Sci."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"107","DOI":"10.1007\/s10791-025-09641-y","article-title":"A Systematic Literature Review on Intrusion Detection Techniques in Cloud Computing","volume":"28","author":"Nasim","year":"2025","journal-title":"Discov. Comput."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"100827","DOI":"10.1016\/j.measen.2023.100827","article-title":"A Comprehensive Review of AI Based Intrusion Detection System","volume":"28","author":"Sowmya","year":"2023","journal-title":"Meas. Sens."},{"key":"ref_7","unstructured":"ENISA (2023). ENISA Threat Landscape 2023, European Union Agency for Cybersecurity. Available online: https:\/\/www.enisa.europa.eu\/publications\/enisa-threat-landscape-2023."},{"key":"ref_8","unstructured":"(2026, May 10). New Study Finds 84% of Security Professionals Experienced an API Security Incident. Available online: https:\/\/www.akamai.com\/newsroom\/press-release\/new-study-finds-84-of-security-professionals-experienced-an-api-security-incident-in-the-past-year."},{"key":"ref_9","unstructured":"ISC2 (2026, May 10). ISC2 2024 Cybersecurity Workforce Study. Available online: https:\/\/www.isc2.org\/Insights\/2024\/10\/ISC2-2024-Cybersecurity-Workforce-Study."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Ban, T., Takahashi, T., Ndichu, S., and Inoue, D. (2023). Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response. Appl. Sci., 13.","DOI":"10.3390\/app13116610"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Gonz\u00e1lez-Granadillo, G., Gonz\u00e1lez-Zarzosa, S., and Diaz, R. (2021). Security Information and Event Management (SIEM): Analysis, Trends, and Usage in Critical Infrastructures. Sensors, 21.","DOI":"10.3390\/s21144759"},{"key":"ref_12","unstructured":"(2026, May 10). AI SIEM: Next-Gen SIEM Powered by AI. Available online: https:\/\/www.crowdstrike.com\/en-us\/cybersecurity-101\/next-gen-siem\/aisiem\/."},{"key":"ref_13","first-page":"4414","article-title":"Federated Security Control Data Fabric: Scalable Telemetry Normalization and Orchestration in Multi-Cloud Environments","volume":"11","author":"Thandayutham","year":"2025","journal-title":"Int. J. Cloud Comput. Serv."},{"key":"ref_14","unstructured":"Palo Alto Networks (2026, May 10). What is Extended Detection and Response (XDR)?. Available online: https:\/\/www.paloaltonetworks.com\/cyberpedia\/what-is-extended-detection-response-XDR."},{"key":"ref_15","unstructured":"(2026, May 10). Market Guide: Extended Detection and Response. Available online: https:\/\/www.gartner.com\/reviews\/market\/extended-detection-and-response."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"24","DOI":"10.54254\/2755-2721\/82\/2024GLG0054","article-title":"Advanced AI and ML Techniques in Cybersecurity: Supervised and Unsupervised Learning, Reinforcement Learning and Neural Networks in Threat Detection and Response","volume":"82","author":"Meng","year":"2024","journal-title":"Appl. Comput. Eng."},{"key":"ref_17","unstructured":"Diogenes, Y., DiCola, N., and Turpijn, T. (2022). Microsoft Azure Sentinel: Planning and Implementing Microsoft\u2019s Cloud-Native SIEM Solution, Microsoft Press."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Pitkar, H. (2025). Cloud Security Automation Through Symmetry: Threat Detection and Response. Symmetry, 17.","DOI":"10.3390\/sym17060859"},{"key":"ref_19","first-page":"28","article-title":"The Role of Artificial Intelligence in SOC Operations: Adoption, Perception, and Workforce Impact","volume":"Volume 4134","author":"Boughton","year":"2025","journal-title":"Proceedings of the 11th International Workshop on Socio-Technical Perspectives in Information Systems (STPIS 2025)"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"104702","DOI":"10.1016\/j.cose.2025.104702","article-title":"Proactive Threat Detection in Enterprise Systems Using Wazuh: A MITRE ATT&CK Evaluation","volume":"159","author":"Winkler","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Farzaan, M.A.M., Ghanem, M.C., El-Hajjar, A., and Ratnayake, D.N. (2024). AI-Enabled System for Efficient and Effective Cyber Incident Detection and Response in Cloud Environments. arXiv.","DOI":"10.1109\/TMLCN.2025.3564912"},{"key":"ref_22","unstructured":"NIST (2018). Framework for Improving Critical Infrastructure Cybersecurity (NIST CSF v1.1), National Institute of Standards and Technology."},{"key":"ref_23","first-page":"1","article-title":"Zero trust architecture","volume":"800","author":"Rose","year":"2020","journal-title":"NIST Spec. Publ."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1186\/s13677-025-00764-7","article-title":"SmartTrust: A Hybrid Deep Learning Framework for Real-Time Threat Detection in Cloud Environments Using Zero-Trust Architecture","volume":"14","author":"Lilhore","year":"2025","journal-title":"J. Cloud Comput."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1319","DOI":"10.1002\/smj.640","article-title":"Explicating Dynamic Capabilities: The Nature and Microfoundations of (Sustainable) Enterprise Performance","volume":"28","author":"Teece","year":"2007","journal-title":"Strateg. Manag. J."},{"key":"ref_26","unstructured":"Creswell, J.W., and Plano Clark, V.L. (2017). Designing and Conducting Mixed Methods Research, SAGE Publications. [3rd ed.]."}],"container-title":["Applied Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2076-3417\/16\/13\/6454\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T03:53:04Z","timestamp":1782791584000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2076-3417\/16\/13\/6454"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,29]]},"references-count":26,"journal-issue":{"issue":"13","published-online":{"date-parts":[[2026,7]]}},"alternative-id":["app16136454"],"URL":"https:\/\/doi.org\/10.3390\/app16136454","relation":{},"ISSN":["2076-3417"],"issn-type":[{"value":"2076-3417","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,29]]}}}