Explainable Artificial Intelligence for Industrial Cybersecurity: A Review of Methods, Operational Integration, and Research Challenges

AI systems are increasingly used in industrial cybersecurity operations, but their "black box" decision-making creates trust problems: The paper identifies that while AI and machine learning improve threat detection in Security Operations Centers (SOCs), their opaque nature challenges operational trust, regulatory compliance, and incident response—meaning security teams may not understand why the system flagged a threat as dangerous.

Explainable AI (XAI) techniques can make industrial cybersecurity systems more transparent: The review examines multiple XAI approaches including feature attribution methods, surrogate models, rule-based explanations, and visualization techniques that can help security professionals understand and verify AI decisions in real-time threat analysis.

Industrial cybersecurity has unique requirements that differ from general AI applications: The paper emphasizes that industrial systems (IT/OT convergence) have distinct operational, regulatory, and safety requirements that standard XAI solutions may not adequately address, requiring tailored approaches for this critical infrastructure context.

Explainability is essential for regulatory compliance and incident response: Beyond trust, the paper highlights that transparency in AI-driven security decisions is necessary for meeting regulatory requirements and enabling effective incident response when security teams need to explain why automated actions were taken.