📄 Sciences Methods and Technologies
International Journal (SciMeTech)

Security Operations Centers (SOCs) are facing a structural crisis driven by rising alert volumes, increasingly sophisticated adversaries, and analyst fatigue. Despite significant investment in SIEM platforms and rule-based detection systems, IBM's Cost of a Data Breach Report 2023 indicates that the average breach still requires 197 days to identify [1]. The root cause is clear: SOC failure is primarily architectural in nature, not operational — organizations have invested in the right people and processes, but the underlying detection architecture is no longer fit for purpose.

This paper presents a practitioner-driven framework for AI-augmented SOC transformation based on three operational pillars: Asset Visibility, Detection Engineering, and Accelerated Remediation. The proposed approach integrates traditional cybersecurity frameworks (MITRE ATT&CK, NIST RMF, OWASP Top 10) with emerging AI-focused frameworks (MITRE ATLAS, NIST AI RMF, OWASP LLM Top 10, OWASP MCP Top 10), creating a unified detection and governance model capable of addressing both conventional and AI-driven threats.

A comparative detection model is introduced to evaluate SOC performance across traditional, AI-enabled, and hybrid architectures. The analysis demonstrates that neither rule-based SOCs nor standalone AI-driven SOCs are sufficient in isolation due to limitations such as detection gaps, bias, hallucination, and lack of contextual confidence. The proposed hybrid model—combining traditional detection logic, AI augmentation, and Human-in-the-Loop (HITL) decision-making—achieves significantly improved detection fidelity, reduced false positives, and faster response cycles.

Results from a controlled scenario-based validation demonstrate measurable improvements in Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and analyst workload reduction.