{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,27]],"date-time":"2026-10-27T19:36:09Z","timestamp":1793129769185,"version":"4.5.0"},"reference-count":73,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T00:00:00Z","timestamp":1719792000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JCP"],"abstract":"<jats:p>The continuous integration of automated tools into security operation centers (SOCs) increases the volume of alerts for security analysts. This amplifies the risk of automation bias and complacency to the point that security analysts have reported missing, ignoring, and not acting upon critical alerts. Enhancing the SOC environment has predominantly been researched from a technical standpoint, failing to consider the socio-technical elements adequately. However, our research fills this gap and provides practical insights for optimizing processes in SOCs. The synergy between security analysts and automation can potentially augment threat detection and response capabilities, ensuring a more robust defense if effective human-automation collaboration is established. A scoping review of 599 articles from four databases led to a final selection of 49 articles. Thematic analysis resulted in 609 coding references generated across four main themes: SOC automation challenges, automation application areas, implications on analysts, and human factor sentiment. Our findings emphasize the extent to which automation can be implemented across the incident response lifecycle. The SOC Automation Matrix represents our primary contribution to achieving a mutually beneficial relationship between analyst and machine. This matrix describes the properties of four distinct human-automation combinations. This is of practical value to SOCs striving to optimize their processes, as our matrix mentions socio-technical system characteristics for automated tools.<\/jats:p>","DOI":"10.3390\/jcp4030020","type":"journal-article","created":{"date-parts":[[2024,7,3]],"date-time":"2024-07-03T08:45:34Z","timestamp":1719996334000},"page":"388-409","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":30,"title":["Humans and Automation: Augmenting Security Operation Centers"],"prefix":"10.3390","volume":"4","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3130-8863","authenticated-orcid":false,"given":"Jack","family":"Tilbury","sequence":"first","affiliation":[{"name":"School of Cyber Studies, The University of Tulsa, Tulsa, OK 74104, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4591-3802","authenticated-orcid":false,"given":"Stephen","family":"Flowerday","sequence":"additional","affiliation":[{"name":"School of Cyber Studies, The University of Tulsa, Tulsa, OK 74104, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2024,7,1]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"34352","DOI":"10.1109\/ACCESS.2022.3161636","article-title":"DomainPrio: Prioritizing Domain Name Investigations to Improve SOC Efficiency","volume":"10","author":"Chiba","year":"2022","journal-title":"IEEE Access"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Hus\u00e1k, M., and \u010cerm\u00e1k, M. (2022). SoK: Applications and Challenges of Using Recommender Systems in Cybersecurity Incident Handling and Response. ARES \u201922: Proceedings of the 17th International Conference on Availability, Reliability and Security, Vienna Austria, 23\u201326 August 2022, Association for Computing Machinery.","DOI":"10.1145\/3538969.3538981"},{"key":"ref_3","unstructured":"Coro Cybersecurity (2024, January 12). 2024 SME Security Workload Impact Report; Coro Cybersecurity. 2023; pp. 1\u201311. Available online: https:\/\/www.coro.net\/sme-security-workload-impact-report."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1080\/00221309.1993.9711153","article-title":"Individual Differences in Monitoring Failures of Automation","volume":"120","author":"Singh","year":"1993","journal-title":"J. Gen. Psychol."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"991","DOI":"10.1006\/ijhc.1999.0252","article-title":"Does Automation Bias Decision-Making?","volume":"51","author":"Skitka","year":"1999","journal-title":"Int. J. Hum.-Comput. Stud."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1454","DOI":"10.1177\/1541931213601333","article-title":"An Investigation of Trust in a Cyber Security Tool","volume":"60","author":"Brown","year":"2016","journal-title":"Proc. Hum. Factors Ergon. Soc. Annu. Meet."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"102020","DOI":"10.1016\/j.cose.2020.102020","article-title":"When believing in technology leads to poor cyber security: Development of a trust in technical controls scale","volume":"98","author":"Butavicius","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_8","unstructured":"Cain, A.A. (2016). Trust and Complacency in Cyber Security. [Master\u2019s Thesis, San Jose State University]."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"463","DOI":"10.1109\/THMS.2021.3051137","article-title":"Automation Error Type and Methods of Communicating Automation Reliability Affect Trust and Performance: An Empirical Study in the Cyber Domain","volume":"51","author":"Chen","year":"2021","journal-title":"IEEE Trans. Human-Mach. Syst."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"442","DOI":"10.1177\/1071181319631079","article-title":"Opportunities and Challenges for Human-Machine Teaming in Cybersecurity Operations","volume":"63","author":"Blaha","year":"2019","journal-title":"Proc. Hum. Factors Ergon. Soc. Annu. Meet."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"452","DOI":"10.1007\/978-3-030-22351-9_31","article-title":"Trust in Automated Software Repair: The Effects of Repair Source, Transparency, and Programmer Experience on Perceived Trustworthiness and Trust","volume":"Volume 11594","author":"Moallem","year":"2019","journal-title":"Proceedings of the HCI for Cybersecurity, Privacy and Trust"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"103201","DOI":"10.1016\/j.cose.2023.103201","article-title":"Testing SOAR Tools in Use","volume":"129","author":"Bridges","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"20216","DOI":"10.1109\/ACCESS.2023.3248652","article-title":"Toward a Superintelligent Action Recommender for Network Operation Centers Using Reinforcement Learning","volume":"11","author":"Altamimi","year":"2023","journal-title":"IEEE Access"},{"key":"ref_14","unstructured":"Crowley, C., Filkins, B., and Pescatore, J. (2023). SANS 2023 SOC Survey, SANS Institure. Available online: https:\/\/www.sans.org\/white-papers\/2023-sans-soc-survey\/."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"102959","DOI":"10.1016\/j.cose.2022.102959","article-title":"A Systematic Method for Measuring the Performance of a Cyber Security Operations Centre Analyst","volume":"124","author":"Agyepong","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Shahjee, D., and Ware, N. (2022). Integrated Network and Security Operation Center: A Systematic Analysis. IEEE Access, 10.","DOI":"10.1109\/ACCESS.2022.3157738"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"89","DOI":"10.1518\/155723405783703082","article-title":"Human-Automation Interaction","volume":"1","author":"Sheridan","year":"2005","journal-title":"Rev. Hum. Factors Ergon."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Hauptman, A.I., Schelble, B.G., McNeese, N.J., and Madathil, K.C. (2023). Adapt and Overcome: Perceptions of Adaptive Autonomous Agents for Human-AI Teaming. Comput. Hum. Behav., 138.","DOI":"10.1016\/j.chb.2022.107451"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"182","DOI":"10.1177\/154193120304700138","article-title":"Beyond Levels of Automation: An Architecture for More Flexible Human-Automation Collaboration","volume":"47","author":"Miller","year":"2003","journal-title":"Proc. Hum. Factors Ergon. Soc. Annu. Meet."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Applebaum, A., Johnson, S., Limiero, S., and Smith, M. (2018, January 5). Smith Playbook Oriented Cyber Response. Proceedings of the 2018 National Cyber Summit (NCS), Huntsville, AL, USA.","DOI":"10.1109\/NCS.2018.00007"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"2119","DOI":"10.11124\/JBIES-20-00167","article-title":"Updated Methodological Guidance for the Conduct of Scoping Reviews","volume":"18","author":"Peters","year":"2020","journal-title":"JBI Evid. Synth."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1191\/1478088706qp063oa","article-title":"Using Thematic Analysis in Psychology","volume":"3","author":"Braun","year":"2006","journal-title":"Qual. Res. Psychol."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1080\/07366981.2021.1977026","article-title":"The Human Factor Capabilities in Security Operation Centers (SOC)","volume":"66","author":"Chamkar","year":"2022","journal-title":"EDPACS"},{"key":"#cr-split#-ref_24.1","doi-asserted-by":"crossref","unstructured":"Kokulu, F.B., Soneji, A., Bao, T., Shoshitaishvili, Y., Zhao, Z., Doup\u00e9, A., and Ahn, G.-J. (2019). Matched and Mismatched SOCs: A Qualitative Study on Security Operations Center Issues. CCS '19","DOI":"10.1145\/3319535.3354239"},{"key":"#cr-split#-ref_24.2","unstructured":"Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, London, UK, 11-15 November 2019, Association for Computing Machinery."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"227756","DOI":"10.1109\/ACCESS.2020.3045514","article-title":"Security Operations Center: A Systematic Study and Open Challenges","volume":"8","author":"Vielberth","year":"2020","journal-title":"IEEE Access"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Amthor, P., Fischer, D., K\u00fchnhauser, W.E., and Stelzer, D. (2019). Automated Cyber Threat Sensing and Responding: Integrating Threat Intelligence into Security-Policy-Controlled Systems. ARES \u201919, Proceedings of the 14th International Conference on Availability, Reliability and Security, Canterbury, UK, 26\u201329 August 2019, Association for Computing Machinery.","DOI":"10.1145\/3339252.3340509"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1007\/978-3-030-41579-2_9","article-title":"Automated Cyber Threat Intelligence Reports Classification for Early Warning of Cyber Attacks in Next Generation SOC","volume":"Volume 11999","author":"Zhou","year":"2020","journal-title":"Information and Communications Security"},{"key":"ref_28","first-page":"353","article-title":"Self-Aware Effective Identification and Response to Viral Cyber Threats","volume":"Volume 2021","author":"Jancarkova","year":"2021","journal-title":"Proceedings of the 13th International Conference on Cyber Conflict (CyCon)"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Strickson, B., Worsley, C., and Bertram, S. (June, January 30). Human-Centered Assessment of Automated Tools for Improved Cyber Situational Awareness. Proceedings of the 2023 15th International Conference on Cyber Conflict: Meeting Reality (CyCon), Tallinn, Estonia.","DOI":"10.23919\/CyCon58705.2023.10181567"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"103370","DOI":"10.1016\/j.jnca.2022.103370","article-title":"SmartValidator: A Framework for Automatic Identification and Classification of Cyber Threat Data","volume":"202","author":"Islam","year":"2022","journal-title":"J. Network. Comput. Appl."},{"key":"ref_31","unstructured":"Basyurt, A.S., Fromm, J., Kuehn, P., Kaufhold, M.-A., and Mirbabaie, M. (2022, January 21\u201323). Help Wanted-Challenges in Data Collection, Analysis and Communication of Cyber Threats in Security Operation Centers. Proceedings of the 17th International Conference on Wirtschaftsinformatik, Available online: https:\/\/www.scopus.com\/inward\/record.uri?eid=2-s2.0-85171997510&partnerID=40&md5=30a02b455898c7c2c9d2421d82606470."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Hughes, K., McLaughlin, K., and Sezer, S. (2020, January 11\u201312). Dynamic Countermeasure Knowledge for Intrusion Response Systems. Proceedings of the Irish Signals and Systems Conference (ISSC), Letterkenny, Ireland.","DOI":"10.1109\/ISSC49989.2020.9180198"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Gupta, N., Traore, I., and de Quinan, P.M.F. (2019, January 9\u201312). Automated Event Prioritization for Security Operation Center Using Deep Learning. Proceedings of the 2019 IEEE International Conference on Big Data (Big Data), Los Angeles, CA, USA.","DOI":"10.1109\/BigData47090.2019.9006073"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Renners, L., Heine, F., Kleiner, C., and Rodosek, G.D. (2019, January 3\u20134). Adaptive and Intelligible Prioritization for Network Security Incidents. Proceedings of the 2019 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), Oxford, UK.","DOI":"10.1109\/CyberSecPODS.2019.8885208"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"102535","DOI":"10.1016\/j.cose.2021.102535","article-title":"Developing Decision Support for Cybersecurity Threat and Incident Managers","volume":"113","author":"Schraagen","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1145\/3474718.3474723","article-title":"Combat Security Alert Fatigue with AI-Assisted Techniques","volume":"Volume 21","author":"Ban","year":"2021","journal-title":"CSET \u201921: Proceedings of the 14th Cyber Security Experimentation and Test Workshop, Virtual, 9 August 2021"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"112392","DOI":"10.1109\/ACCESS.2022.3216617","article-title":"Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities","volume":"10","author":"Neupane","year":"2022","journal-title":"IEEE Access"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"204","DOI":"10.1109\/TVCG.2018.2865029","article-title":"Situ: Identifying and Explaining Suspicious Behavior in Networks","volume":"25","author":"Goodall","year":"2019","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Ndichu, S., Ban, T., Takahashi, T., and Inoue, D. (2021, January 15\u201318). A Machine Learning Approach to Detection of Critical Alerts from Imbalanced Multi-Appliance Threat Alert Logs. Proceedings of the IEEE International Conference on Big Data (Big Data), Orlando, FL, USA.","DOI":"10.1109\/BigData52589.2021.9671956"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"103069","DOI":"10.1016\/j.cose.2022.103069","article-title":"Understanding Situation Awareness in SOCs, a Systematic Literature Review","volume":"126","author":"Ofte","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Akinrolabu, O., Agrafiotis, I., and Erola, A. (2018, January 27\u201330). The Challenge of Detecting Sophisticated Attacks: Insights from SOC Analysts. Proceedings of the 13th International Conference on Availability, Reliability and Security, Hamburg, Germany.","DOI":"10.1145\/3230833.3233280"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Yen, T.-F., Oprea, A., Onarlioglu, K., Leetham, T., Robertson, W., Juels, A., and Kirda, E. (2013). Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks. ACSAC \u201913: Proceedings of the 29th Annual Computer Security Applications Conference, New Orleans, LA, USA, 9\u201313 December 2013, Association for Computing Machinery.","DOI":"10.1145\/2523649.2523670"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"603","DOI":"10.1109\/JSYST.2018.2828832","article-title":"Learning From Experts\u2019 Experience: Toward Automated Cyber Security Data Triage","volume":"13","author":"Zhong","year":"2019","journal-title":"IEEE Syst. J."},{"key":"ref_44","unstructured":"Alahmadi, B.A., Axon, L., and Martinovic, I. (2022, January 10\u201312). 99% False Positives: A Qualitative Study of SOC Analysts\u2019 Perspectives on Security Alarms. Proceedings of the 31st Usenix Security Symposium, Boston, MA, USA."},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"106856","DOI":"10.1016\/j.infsof.2022.106856","article-title":"Context2Vector: Accelerating Security Event Triage via Context Representation Learning","volume":"146","author":"Liu","year":"2022","journal-title":"Inf. Softw. Technol."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Gutzwiller, R.S., Fugate, S., Sawyer, B.D., and Hancock, P.A. (2015, January 26\u201330). The Human Factors of Cyber Network Defense. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, Los Angeles, CA, USA.","DOI":"10.1177\/1541931215591067"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Chung, M.-H., Yang, Y., Wang, L., Cento, G., Jerath, K., Raman, A., Lie, D., and Chignell, M.H. (2023). Implementing Data Exfiltration Defense in Situ: A Survey of Countermeasures and Human Involvement. ACM Comput. Surv., 55.","DOI":"10.1145\/3582077"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Sworna, Z.T., Islam, C., and Babar, M.A. (2023). APIRO: A Framework for Automated Security Tools API Recommendation. ACM Trans. Softw. Eng. Methodol., 32.","DOI":"10.1145\/3512768"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Hassan, W.U., Guo, S., Li, D., Chen, Z., Jee, K., Li, Z., and Bates, A. (2019, January 24\u201327). NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage. Proceedings of the 2019 Network and Distributed System Security Symposium, San Diego, CA, USA.","DOI":"10.14722\/ndss.2019.23349"},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3450973","article-title":"Assessing a Decision Support Tool for SOC Analysts","volume":"2","author":"Happa","year":"2021","journal-title":"Digit. Threats: Res. Pract."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"19089","DOI":"10.1109\/ACCESS.2020.2966760","article-title":"From Logs to Stories: Human-Centred Data Mining for Cyber Threat Intelligence","volume":"8","author":"Afzaliseresht","year":"2020","journal-title":"IEEE Access"},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Kurogome, Y., Otsuki, Y., Kawakoya, Y., Iwamura, M., Hayashi, S., Mori, T., and Sen, K. (2019). EIGER: Automated IOC Generation for Accurate and Interpretable Endpoint Malware Detection. ACSAC \u201919: Proceedings of the 35th Annual Computer Security Applications Conference, San Juan, PR, USA, 9\u201313 December 2019, Association for Computing Machinery.","DOI":"10.1145\/3359789.3359808"},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Dietrich, C., Krombholz, K., Borgolte, K., and Fiebig, T. (2018, January 15\u201319). Investigating System Operators\u2019 Perspective on Security Misconfigurations. Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.","DOI":"10.1145\/3243734.3243794"},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Oprea, A., Li, Z., Norris, R., and Bowers, K. (2018). MADE: Security Analytics for Enterprise Threat Detection. ACSAC\u201918: Proceedings of the 34th Annual Computer Security Applications Conference, San Juan, PR, USA, 3\u20137 December 2018, Association for Computing Machinery.","DOI":"10.1145\/3274694.3274710"},{"key":"ref_55","doi-asserted-by":"crossref","first-page":"527","DOI":"10.32604\/iasc.2021.016240","article-title":"Ai\/Ml in Security Orchestration, Automation and Response: Future Research Directions","volume":"28","author":"Kinyua","year":"2021","journal-title":"Intell. Autom. Soft Comp."},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Van Ede, T., Aghakhani, H., Spahn, N., Bortolameotti, R., Cova, M., Continella, A., van Steen, M., Peter, A., Kruegel, C., and Vigna, G. (2022, January 23\u201325). DEEPCASE: Semi-Supervised Contextual Analysis of Security Events. Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP46214.2022.9833671"},{"key":"ref_57","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3491260","article-title":"Building Machine Learning-Based Threat Hunting System from Scratch","volume":"3","author":"Chen","year":"2022","journal-title":"Digital Threats"},{"key":"ref_58","doi-asserted-by":"crossref","unstructured":"Erola, A., Agrafiotis, I., Happa, J., Goldsmith, M., Creese, S., and Legg, P.A. (2017, January 19\u201320). RicherPicture: Semi-Automated Cyber Defence Using Context-Aware Data Analytics. Proceedings of the 2017 International Conference on Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA), London, UK.","DOI":"10.1109\/CyberSA.2017.8073399"},{"key":"ref_59","doi-asserted-by":"crossref","first-page":"102334","DOI":"10.1016\/j.ijinfomgt.2021.102334","article-title":"Real-Time Analytics, Incident Response Process Agility and Enterprise Cybersecurity Performance: A Contingent Resource-Based Analysis","volume":"59","author":"Naseer","year":"2021","journal-title":"Int. J. Inf. Manag."},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Andrade, R.O., and Yoo, S.G. (2019). Cognitive Security: A Comprehensive Study of Cognitive Science in Cybersecurity. J. Inf. Secur. Appl., 48.","DOI":"10.1016\/j.jisa.2019.06.008"},{"key":"ref_61","doi-asserted-by":"crossref","first-page":"102609","DOI":"10.1016\/j.cose.2022.102609","article-title":"CRUSOE: A Toolset for Cyber Situational Awareness and Decision Support in Incident Handling","volume":"115","author":"Sadlek","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_62","doi-asserted-by":"crossref","unstructured":"Chamberlain, L.B., Davis, L.E., Stanley, M., and Gattoni, B.R. (2020, January 18\u201320). Automated Decision Systems for Cybersecurity and Infrastructure Security. Proceedings of the 2020 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA.","DOI":"10.1109\/SPW50608.2020.00048"},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Gonz\u00e1lez-Granadillo, G., Gonz\u00e1lez-Zarzosa, S., and Diaz, R. (2021). Security Information and Event Management (SIEM): Analysis, Trends, and Usage in Critical Infrastructures. Sensors, 21.","DOI":"10.3390\/s21144759"},{"key":"ref_64","doi-asserted-by":"crossref","unstructured":"Demertzis, K., Tziritas, N., Kikiras, P., Sanchez, S.L., and Iliadis, L. (2019). The next Generation Cognitive Security Operations Center: Adaptive Analytic Lambda Architecture for Efficient Defense against Adversarial Attacks. Big Data Cogn. Comput., 3.","DOI":"10.3390\/bdcc3010006"},{"key":"ref_65","first-page":"87","article-title":"The Rationality of Automation Bias in Security Operation Centers","volume":"20","author":"Tilbury","year":"2024","journal-title":"J. Inf. Syst. Secur."},{"key":"ref_66","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1016\/j.ijhcs.2019.05.006","article-title":"History and Future of Human-Automation Interaction","volume":"131","author":"Janssen","year":"2019","journal-title":"Int. J. Hum.-Comput. Stud."},{"key":"ref_67","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1016\/j.sbspro.2014.07.103","article-title":"An Application of the Boston Matrix within Financial Analysis of NGOs","volume":"147","year":"2014","journal-title":"Procedia-Soc. Behav. Sci."},{"key":"ref_68","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., and Srikumar, V. (November, January 30). DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.","DOI":"10.1145\/3133956.3134015"},{"key":"ref_69","doi-asserted-by":"crossref","first-page":"103355","DOI":"10.1016\/j.cose.2023.103355","article-title":"SCOUT: Security by Computing OUTliers on Activity Logs","volume":"132","author":"Ianni","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_70","doi-asserted-by":"crossref","first-page":"e04714","DOI":"10.1016\/j.heliyon.2020.e04714","article-title":"Information Privacy Behavior in the Use of Facebook Apps: A Personality-Based Vulnerability Assessment","volume":"6","author":"Flowerday","year":"2020","journal-title":"Heliyon"},{"key":"ref_71","doi-asserted-by":"crossref","first-page":"462","DOI":"10.1080\/001401399185595","article-title":"Level of Automation Effects on Performance, Situation Awareness and Workload in a Dynamic Control Task","volume":"42","author":"Endsley","year":"1999","journal-title":"Ergonomics"},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Tilbury, J., and Flowerday, S. (2024). Automation Bias and Complacency in Security Operation Centers. Computers, Forthcoming.","DOI":"10.3390\/computers13070165"}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/4\/3\/20\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T15:08:46Z","timestamp":1760108926000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/4\/3\/20"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,1]]},"references-count":73,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2024,9]]}},"alternative-id":["jcp4030020"],"URL":"https:\/\/doi.org\/10.3390\/jcp4030020","relation":{},"ISSN":["2624-800X"],"issn-type":[{"value":"2624-800X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,7,1]]}}}