Symbiotic Human–AI Collaboration for Augmented Cybersecurity Operations

Abstract

Security Operations Centres (SOCs) face mounting cognitive and operational demands as cyber threats increase in scale and complexity. This paper proposes a human-AI collaboration framework to augment SOC effectiveness through cognitive profiling and agentic coordination. We map 29 core SOC functions across three cognitive dimensions, thinking mode, attention level, and coordination context, revealing a concentration of tasks in cognitively saturated zones requiring slow thinking, high attention, or collective decision-making. To address these challenges, we introduce a multi-agent architecture grounded in the Belief–Desire–Intention (BDI) model and structured by an extended VOWEL+U framework that embeds human oversight into agentic ecosystems. We define four AI agent roles, Assistant, Auto-Pilot, Companion, and Operator, aligned with operational autonomy levels to support function-specific delegation. Building on this, we propose a new SOC function: Agent Collaboration and Oversight (F30), reflecting the emerging need for human supervision and configuration of agentic behaviour. Together, these contributions outline a path toward symbiotic human-AI SOCs, which can shift cognitive load, enhance decision quality, and ensure accountable, adaptive cyberdefence.