Human-Automation Preferences in Security Operations Centers

In automation-heavy Security operation centers (SOCs), analysts face risks of automation bias and complacency. Surveying 720 analysts using PLS-SEM, we explored preferences for human versus automated task handling at two different stages of the incident response lifecycle. Results exposed a stark dichotomy: analysts favored entirely human-driven or fully automated processes, expressing little desire for intermediate collaborative approaches. This presents a challenge for integrating necessary automation effectively. Gradual, evolutionary implementation is advised over revolutionary, disruptive changes to encourage acceptance.