Human–AI Interaction in Cybersecurity: A Theoretical Study on Cognitive Bias and Decision Reliability

Abstract

Security Operations Centers (SOCs) increasingly employ artificial intelligence (AI) to detect, filter, prioritize, and interpret security alerts. However, the effectiveness of AI-assisted cybersecurity depends not only on detection accuracy but also on how analysts interpret and act upon AI-generated recommendations. This paper examines human–AI decision-making in SOCs as a socio-technical process shaped by cognitive biases and AI transparency. Particular attention is given to automation bias, algorithm aversion, and confirmation bias, as well as the roles of explanations, supporting evidence, and uncertainty communication in AI-assisted alert management. A layered conceptual framework is proposed, comprising the human layer, the AI detection layer, and the human–AI interaction layer. The framework conceptualizes decision reliability as a function of cognitive bias, explanation quality, uncertainty communication, workload, and calibrated trust. Three testable hypotheses are formulated and operationalized through measurable indicators, including unverified acceptance of AI recommendations, false dismissal rates, hypothesis revision behavior, and trust alignment. The framework is developed through a focused semi-systematic synthesis of the literature on human–AI decision-making, trust calibration, explainable AI, cognitive biases, and SOC operations. To support future empirical evaluation, a reproducible validation approach is outlined, incorporating hypothesis operationalization, planned statistical analyses, and agent-based simulation. A structured comparison with existing human–AI decision-making models and SOC-related studies is conducted to clarify the framework’s contributions and limitations. The study contributes a theoretically grounded and empirically testable framework for investigating decision reliability in AI-assisted SOC environments, highlighting the interplay among cognitive bias, transparency, workload, and trust while reserving the assessment of predictive validity for future empirical research.