Human-AI Integration in Cybersecurity: An Industry-Aligned Perspective on Incident Management

Abstract The integration of Artificial Intelligence (AI) into cybersecurity incident management has gained momentum amid rising threats and increasing operational complexity. While academic research has been widely analysed and found to predominantly address detection tasks and algorithmic performance, the industry perspective remains under-explored, with limited understanding of its practices and priorities. This paper presents a document analysis of a rich corpus of publicly available, industry-issued reports, to examine how AI is understood, deployed, and evaluated in real-world cybersecurity operations. By contextualising the well-established Technology-Human-Task-Context (THTC) framework to the cybersecurity domain, we identify key dimensions shaping AI integration, including task alignment, human oversight, operational constraints, and expected benefits. Our findings highlight critical gaps in current implementations, such as limited attention to recovery, governance, and task assignment, and emphasise the dual role of human experts as both controllers and beneficiaries. To address these gaps and support actionable system design, we propose a set of industry-aligned recommendations derived from a synthesis of the THTC framework and document analysis. These recommendations encompass AI capabilities, integration requirements, task alignment, outcomes, risk management, control mechanisms, and human factors. Our work offers a comprehensive foundation for aligning academic research with industry needs, guiding the development of AI-powered cybersecurity expert systems that are technically effective, ethically sound, and operationally viable.