{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,27]],"date-time":"2026-10-27T16:32:28Z","timestamp":1793118748403,"version":"4.5.0"},"reference-count":34,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100013443","name":"Swedish Institute","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100013443","id-type":"DOI","asserted-by":"crossref"}]},{"id":[{"id":"https:\/\/ror.org\/022w3f533","id-type":"ROR","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100019290","name":"Halmstad University","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100019290","id-type":"DOI","asserted-by":"crossref"}]},{"id":[{"id":"https:\/\/ror.org\/03h0qfp10","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J. Cybersecur. Priv.","JCP"],"abstract":"<jats:p>Security Operations Centers increasingly use artificial intelligence to rank alerts, summarize evidence, and automate repetitive response actions. However, AI-enabled security operations can also create new risks for incident response and digital forensic reliability, including false-negative prioritization, model drift, hallucinated explanations, prompt injection, automation bias, unsafe SOAR actions, and evidence contamination. This article proposes a risk-driven deployment and forensic readiness framework for AI-enabled Security Operations Centers. The framework combines Monte Carlo loss simulation, detector threshold analysis, analyst queueing, model-drift monitoring, and evidence-preserving governance controls. It explicitly separates evidence, recommendation, and action so that AI can accelerate triage while preserving source artifacts, provenance, audit trails, and chain-of-custody information needed for incident reconstruction. Illustrative simulation results show a mean annualized loss expectancy of USD 1.70 M, a 95% Value-at-Risk of USD 3.85 M and a 99% Value-at-Risk of USD 6.29 M, a detector ROC-AUC of 0.942 and PR-AUC of 0.750 with precision 0.719, recall 0.650 and F1 0.683 at the selected decision threshold of 1.873, a manual triage workload reduction of about 38%, and a reduction in mean time to respond (MTTR, defined throughout as mean time to respond rather than mean time to resolution) from about 44 to 26 min under controlled assumptions. The results are demonstration outputs rather than universal benchmarks. The main contribution is a reproducible governance method for deciding when AI reduces SOC risk, when it transfers risk, and when forensic readiness requires human approval, evidence preservation, or automation rollback.<\/jats:p>","DOI":"10.3390\/jcp6050149","type":"journal-article","created":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T03:19:26Z","timestamp":1788232766000},"page":"149","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Risk-Driven Deployment and Forensic Readiness Framework for AI-Enabled Security Operations Centers"],"prefix":"10.3390","volume":"6","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-2169-6851","authenticated-orcid":false,"given":"Olga","family":"Torstensson","sequence":"first","affiliation":[{"name":"School of Information Technology, Halmstad University, 301 18 Halmstad, Sweden"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"},{"role":"project-administration","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6590-3898","authenticated-orcid":false,"given":"Dmytro","family":"Prokopovych-Tkachenko","sequence":"additional","affiliation":[{"name":"Department of Cybersecurity and Information Technologies, University of Customs and Finance, 49000 Dnipro, Ukraine"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"},{"role":"project-administration","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2284-3418","authenticated-orcid":false,"given":"Alona","family":"Desiatko","sequence":"additional","affiliation":[{"name":"Department of Software Engineering and Cybersecurity, State University of Trade and Economics, 19 Kyoto Street, 02156 Kyiv, Ukraine"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4536-2438","authenticated-orcid":false,"given":"Zoriana","family":"Hbur","sequence":"additional","affiliation":[{"name":"Department of Law and Public Administration, Sumy State Pedagogical University Named After A. S. Makarenko, 87 Romenska Street, 40002 Sumy, Ukraine"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"validation","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9196-8740","authenticated-orcid":false,"given":"Igor","family":"Britchenko","sequence":"additional","affiliation":[{"name":"Institute of Law, Economics and Administration, University of the National Education Commission, 2 Podchorazych Street, 30-084 Krakow, Poland"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"validation","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,1]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"224","DOI":"10.1145\/3723158","article-title":"Alert fatigue in security operations centres: Research challenges and opportunities","volume":"57","author":"Tariq","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Nelson, A., Rekhi, S., Souppaya, M., and Scarfone, K. (2025). Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, National Institute of Standards and Technology. NIST Special Publication 800-61 Revision 3.","DOI":"10.6028\/NIST.SP.800-61r3"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Kent, K., Chevalier, S., Grance, T., and Dang, H. (2006). Guide to Integrating Forensic Techniques into Incident Response, National Institute of Standards and Technology. NIST Special Publication 800-86.","DOI":"10.6028\/NIST.SP.800-86"},{"key":"ref_4","unstructured":"(2012). Information Technology\u2014Security Techniques\u2014Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence (Standard No. ISO\/IEC 27037:2012)."},{"key":"ref_5","unstructured":"Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet, Academic Press. [3rd ed.]."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"S64","DOI":"10.1016\/j.diin.2010.05.009","article-title":"Digital forensics research: The next 10 years","volume":"7","author":"Garfinkel","year":"2010","journal-title":"Digit. Investig."},{"key":"ref_7","first-page":"8","article-title":"The role of machine learning in cybersecurity","volume":"4","author":"Apruzzese","year":"2023","journal-title":"Digit. Threats Res. Pract."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Ban, T., Takahashi, T., Ndichu, S., and Inoue, D. (2023). Breaking alert fatigue: AI-assisted SIEM framework for effective incident response. Appl. Sci., 13.","DOI":"10.3390\/app13116610"},{"key":"ref_9","unstructured":"Gelman, B., Taoufiq, S., V\u00f6r\u00f6s, T., and Berlin, K. (2023). That escalated quickly: An ML framework for alert prioritization. arXiv."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1748","DOI":"10.1109\/COMST.2023.3273282","article-title":"Cyber threat intelligence mining for proactive cybersecurity defense: A survey and new perspectives","volume":"25","author":"Sun","year":"2023","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_11","unstructured":"MITRE (2026, July 17). MITRE ATT&CK: Design and Philosophy. Available online: https:\/\/attack.mitre.org\/."},{"key":"ref_12","unstructured":"FIRST (2026, July 17). Common Vulnerability Scoring System Version 4.0 Specification Document. Available online: https:\/\/www.first.org\/cvss\/."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"527","DOI":"10.32604\/iasc.2021.016240","article-title":"AI\/ML in security orchestration, automation and response: Future research directions","volume":"28","author":"Kinyua","year":"2021","journal-title":"Intell. Autom. Soft Comput."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Norem, S., Rice, A.E., Erwin, S., Bridges, R.A., Oesch, S., and Weber, B. (2021). A mathematical framework for evaluation of SOAR tools with limited survey data. arXiv.","DOI":"10.1007\/978-3-030-95484-0_32"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Kurnia, R., Brata, Z.A., Nelistiani, G.A., Heo, S., Kim, H., and Kim, H. (2025). Toward robust security orchestration and automated response in security operations centers with a hyper-automation approach using agentic artificial intelligence. Information, 16.","DOI":"10.3390\/info16050365"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Habibzadeh, A., Feyzi, F., and Atani, R.E. (2025). Large language models for security operations centers: A comprehensive survey. arXiv.","DOI":"10.1155\/jece\/3383674"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Srinivas, S., Kirk, B., Zendejas, J., Espino, M., Boskovich, M., Bari, A., Dajani, K., and Alzahrani, N. (2025). AI-augmented SOC: A survey of LLMs and agents for security automation. J. Cybersecur. Priv., 5.","DOI":"10.3390\/jcp5040095"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Singh, R., Tariq, S., Jalalvand, F., Chhetri, M.B., Nepal, S., Paris, C., and Lochner, M. (2025). LLMs in the SOC: An empirical study of human-AI collaboration in security operations centres. arXiv.","DOI":"10.1109\/SP63933.2026.00111"},{"key":"ref_19","unstructured":"Saju, M.H., and Azim, A. (2026). Toward autonomous SOC operations: End-to-end LLM framework for threat detection, query generation, and resolution in security operations. arXiv."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Sinha, A., and Wellman, M. (2018, January 24\u201326). SoK: Security and privacy in machine learning. Proceedings of the IEEE European Symposium on Security and Privacy, London, UK.","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref_21","unstructured":"Brundage, M., Avin, S., Clark, J., Toner, H., Eckersley, P., Garfinkel, B., Dafoe, A., Scharre, P., Zeitzoff, T., and Filar, B. (2018). The malicious use of artificial intelligence: Forecasting, prevention, and mitigation. arXiv."},{"key":"ref_22","unstructured":"OWASP Foundation (2026, July 17). OWASP Top 10 for Large Language Model Applications. Available online: https:\/\/owasp.org\/www-project-top-10-for-large-language-model-applications\/."},{"key":"ref_23","unstructured":"National Institute of Standards and Technology (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology. NIST AI 100-1."},{"key":"ref_24","unstructured":"(2022). Information Security, Cybersecurity and Privacy Protection\u2014Guidance on Managing Information Security Risks (Standard No. ISO\/IEC 27005:2022)."},{"key":"ref_25","unstructured":"Freund, J., and Jones, J. (2014). Measuring and Managing Information Risk: A FAIR Approach, Butterworth-Heinemann."},{"key":"ref_26","unstructured":"(2015). Information Technology\u2014Security Techniques\u2014Guidance on Assuring Suitability and Adequacy of Incident Investigative Method (Standard No. ISO\/IEC 27041:2015)."},{"key":"ref_27","unstructured":"(2015). Information Technology\u2014Security Techniques\u2014Incident Investigation Principles and Processes (Standard No. ISO\/IEC 27043:2015)."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Kent, K., and Souppaya, M. (2006). Guide to Computer Security Log Management, National Institute of Standards and Technology. NIST Special Publication 800-92.","DOI":"10.6028\/NIST.SP.800-92"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Dempsey, K., Chawla, N., Johnson, L., Johnston, R., Jones, A., Orebaugh, A., Scholl, M., and Stine, K. (2011). Information Security Continuous Monitoring for Federal Information Systems and Organizations, National Institute of Standards and Technology. NIST Special Publication 800-137.","DOI":"10.6028\/NIST.SP.800-137"},{"key":"ref_30","unstructured":"Carrier, B., and Spafford, E.H. (2004, January 11\u201313). An event-based digital forensic investigation framework. Proceedings of the Digital Forensics Research Workshop, Baltimore, MD, USA."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"147","DOI":"10.1016\/j.diin.2005.04.002","article-title":"A hierarchical, objectives-based framework for the digital investigations process","volume":"2","author":"Beebe","year":"2005","journal-title":"Digit. Investig."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"273","DOI":"10.1016\/j.diin.2014.09.002","article-title":"Impacts of increasing volume of digital forensic data: A survey and future research challenges","volume":"11","author":"Quick","year":"2014","journal-title":"Digit. Investig."},{"key":"ref_33","unstructured":"Ruan, K., Carthy, J., Kechadi, T., and Crosbie, M. (February, January 31). Cloud forensics: An overview. Proceedings of the IFIP International Conference on Digital Forensics, Orlando, FL, USA."},{"key":"ref_34","unstructured":"Lillis, D., Becker, B., O\u2019Sullivan, T., and Scanlon, M. (2016). Current challenges and future research areas for digital forensic investigation. arXiv."}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/6\/5\/149\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,3]],"date-time":"2026-09-03T04:28:40Z","timestamp":1788409720000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/6\/5\/149"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,1]]},"references-count":34,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2026,10]]}},"alternative-id":["jcp6050149"],"URL":"https:\/\/doi.org\/10.3390\/jcp6050149","relation":{},"ISSN":["2624-800X"],"issn-type":[{"value":"2624-800X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,1]]}}}