Generative AI in Security Operations Centers : Opportunities, Challenges, and Perspectives

Security Operations Centers (SOCs) are under growing pressure to manage high alert volumes, complex threats, and limited resources. Generative AI (GenAI) has emerged as a potential tool to support these operations, but its role and impact remain unclear. This thesis explores expert perspectives on how GenAI can be adopted in SOCs, focusing on its practical use cases, risks, readiness requirements, and the future role of analysts. Using a two-round Delphi study with expert participants, the research identified strong support for GenAI in areas like alert triage, enrichment, and reporting. At the same time, respondents emphasized the importance of process maturity, human oversight, and governance as critical conditions for adoption. Key risks included hallucinations, over-trust in outputs, data privacy concerns, and prompt injection. Experts also anticipated changes in analyst roles, with fewer entry-level tasks and greater focus on investigation, validation, and collaboration with AI systems. The study provides practical insights for SOC teams and contributes to the growing conversation on responsible AI use in cybersecurity. It highlights the need for careful integration, clear safeguards, and further research into structured adoption approaches.