Explainable <scp>AI</scp> ( <scp>XAI</scp> ) for Insider Threat Detection: Balancing Security and Transparency in Cloud Computing

ABSTRACT Mitigating insider threats in cloud environments remains highly challenging, as malicious or negligent activities frequently evade traditional defense mechanisms. Although AI‐based models can detect such behaviors effectively, their lack of interpretability often reduces analyst confidence and hinders adoption in mission‐critical settings. To overcome this limitation, we introduce a hybrid detection framework that combines anomaly detection with explainable artificial intelligence (XAI). The framework integrates Shapley Additive Explanations (SHAP), Local Interpretable Model‐Agnostic Explanations (LIME), and counterfactual reasoning to provide transparent and actionable insights into model decisions. Furthermore, we define two quantitative measures—Explainability Score (ES) and Fidelity Score (FS)—to systematically assess interpretability alongside predictive accuracy. Experimental validation on benchmark datasets (CERT, ADFA‐LD) and large‐scale synthetic logs demonstrates that the proposed system achieves 94.5% ± 0.4 accuracy, reduces false positives by 27%, and significantly enhances analyst efficiency. In contrast to conventional black‐box models, the framework strikes a practical balance between accuracy and interpretability, thereby improving trustworthiness and reinforcing security operations in the cloud.