Intelligent Threat Detection Using Explainable AI and Autonomous Incident Response in Cloud Enterprise Security Systems

Cloud enterprise security systems face increasingly sophisticated cyber threats, including credential compromise, lateral movement, privilege escalation, data exfiltration, and previously unknown attack patterns. Traditional security mechanisms often depend on predefined rules and signature-based detection, which may struggle to identify evolving threats across distributed cloud infrastructures. This study proposes an integrated framework combining artificial intelligence (AI), explainable artificial intelligence (XAI), and autonomous incident response to strengthen cloud enterprise security. The framework employs machine learning and behavioral analytics to identify suspicious activities across network traffic, identity events, application logs, and cloud audit records. Explainability techniques provide interpretable justifications for threat classifications, enabling security analysts to understand the factors contributing to alerts and evaluate their operational significance. An autonomous response component uses predefined policies and risk-based decision mechanisms to initiate proportionate containment actions, including session revocation, temporary access restriction, and isolation of affected resources where supported. The research adopts a design-oriented methodology involving data preparation, model development, explainability assessment, controlled incident simulation, and performance evaluation. Detection effectiveness is assessed using precision, recall, F1-score, and false-positive rates, while response performance is evaluated through detection latency, containment time, and response accuracy. Human oversight is incorporated for high-impact or uncertain decisions. The proposed framework aims to improve threat visibility, operational efficiency, and response consistency while preserving accountability. Its expected contribution is a transparent and adaptable security architecture for enterprise cloud environments.