Companion to the AI-SOC Risk Model workbook and simulation toolkit

Security Operations Centers (SOCs) increasingly use machine-learning detectors to prioritize and triage high volumes of alerts that cannot be handled efficiently by human analysts alone. While this improves detection coverage and operational scalability, it also introduces measurable risks, including trade-offs in detector error, analyst overload, false-positive fatigue, automation bias, and model degradation as adversaries adapt their tactics. This package presents a reproducible framework for quantifying risk in AI-driven SOC environments across three main domains: threat exposure, detection capability, and AI-specific failure modes. It includes a Python-based simulation toolkit, generated datasets and figures, and a companion Excel risk model. The framework is built around four complementary simulations. First, a Monte Carlo annualized loss model converts a portfolio of cyber threat scenarios into a full loss distribution, including mean annualized loss expectancy and tail-risk indicators such as Value-at-Risk. Second, a detector-performance model evaluates the precision-recall trade-off and identifies an operating threshold that balances detection coverage with alert volume. Third, an alert-queue model translates SOC alert rates into analyst workload, waiting time, utilization, and staffing requirements. Fourth, a model-drift simulation estimates how detector recall may decay between retraining cycles and how this affects detection reliability over time. Together, these components allow SOC teams, researchers, and risk managers to express AI-SOC risk in operational and quantitative terms: financial loss exposure, detection coverage, service-level performance, analyst capacity, and model-maintenance requirements. The framework is intended for research, teaching, and practical experimentation. The default parameters are illustrative and should be recalibrated with organization-specific data before being used for operational decision-making.