A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy

AI autonomy should be flexible, not binary: Rather than simply turning AI "on" or "off," the framework proposes five graduated levels of AI autonomy matched to task complexity and risk. This allows organizations to give AI more independence for routine tasks while maintaining human control over critical decisions, addressing the limitation that "many assume static or binary autonomy settings."

Trust in AI systems must be actively calibrated and monitored: The framework emphasizes "trust calibration" as a core component, meaning organizations should systematically adjust how much they rely on AI based on performance and context rather than blindly trusting or distrusting AI systems across all situations.

Human oversight remains essential but can be strategized: By mapping different autonomy levels to specific human roles and responsibilities, the framework enables "adaptive task distribution according to operational complexity and associated risks," allowing human experts to focus their attention where it matters most rather than micromanaging routine tasks.

AI can meaningfully reduce alert fatigue in cybersecurity: The case study demonstrates that an AI assistant can help with "reducing alert fatigue" in security operations, a major source of burnout and missed threats, by intelligently filtering and prioritizing alerts for human review.

Responsible AI deployment requires task-specific design: Rather than applying one autonomy level organization-wide, the framework tailors AI's role to specific functions like "monitoring, protection, threat detection, alert triage, and incident response," recognizing that different tasks have different risk profiles and require different levels of human involvement.