Exploring the Role of Artificial Intelligence in Enhancing Security Operations: A Systematic Review

Artificial intelligence (AI) is reshaping Security Operations Centers (SOCs). This systematic literature review analyses AI’s transformative impact across the NIST Cybersecurity Framework. The analysis of 189 papers related to AI use-cases for SOCs shows widespread application of AI for detection, with 65% of studies focusing on it. Yet, it also reveals deficiencies in recovery, the underutilisation of explainable AI models—with 88% of studies relying on non-explainable approaches— the sporadic release of tools as open-source and an over-reliance on proprietary datasets. Common motivations for papers include efficiency, error reduction, and cost savings, with challenges in data reliance, and integration complexity.