The Automation Paradox in Security Operations Centers: A Human-in-the-Loop Framework for Task Suitability

Abstract

Security Operations Centers (SOCs) are increasingly using SOAR platforms and AI-based security tools to improve cybersecurity operations, reduce analyst workload, and respond to threats more quickly. However, despite continued investment in automation, SOC teams still face challenges such as alert fatigue, slow incident response, and highly reactive security operations. This research investigates the automation paradox in SOCs and examines why automation does not always provide the expected operational benefits. The study focuses on limited trust in AI-driven systems, high false-positive alerts, and weak integration between automation tools and existing SOC processes. It also addresses the lack of a widely accepted and validated framework for deciding which SOC tasks should be fully automated, semi-automated with human involvement, or handled mainly by humans. The research follows a mixed-methods approach using structured surveys and semi-structured interviews with SOC analysts, managers, and security architects, together with secondary data from industry reports and peer-reviewed literature. The study aims to identify automation adoption patterns, examine barriers that limit automation effectiveness, evaluate the relationship between automation maturity and MTTD, MTTR, and analyst workload, and develop a validated three-tier framework for automation suitability