Companion to the AI-SOC Risk Model workbook and simulation toolkit

Security Operations Centers (SOCs) increasingly use machine-learning detectors, LLM-assisted triage, and SOAR automation to prioritize and process high volumes of security alerts. These tools can improve detection coverage, scalability, and response speed, but they also introduce measurable risks, including detector error trade-offs, analyst overload, false-positive fatigue, automation bias, model degradation as adversaries adapt their tactics, unsafe automated response, and weakened evidence handling when response actions occur before artifacts are preserved. This package provides the companion workbook and simulation toolkit for the article “Risk-Driven Deployment and Forensic Readiness Framework for AI-Enabled Security Operations Centers,” submitted to the Journal of Cybersecurity and Privacy. It presents a reproducible framework for quantifying risk in AI-enabled SOC environments across four main domains: threat exposure, detection capability, AI-specific failure modes, and forensic readiness. The package includes Python scripts, generated CSV outputs, article figures, a Jupyter notebook, and a companion Excel risk model. The framework is built around four complementary simulations. First, a Monte Carlo annualized-loss model converts a portfolio of cyber threat scenarios into a full loss distribution, including mean annualized loss expectancy, Value-at-Risk, and Tail-Value-at-Risk. Second, a detector-performance model evaluates the precision-recall trade-off and identifies an operating threshold that balances detection coverage with alert volume. Third, an alert-queue model translates SOC alert rates into analyst workload, waiting time, utilization, and staffing requirements. Fourth, a model-drift simulation estimates how detector recall may decay between retraining cycles and how this affects detection reliability over time. These outputs are combined into a composite deployment risk score that maps to explicit AI-SOC deployment states: shadow mode, assisted triage, low-risk automation, analyst-approved containment, or rollback. Analyst workload risk and response automation risk are evaluated separately as gating constraints, because either can veto a deployment state regardless of the composite score. The package also includes sensitivity analyses for the loss model, queueing assumptions, detector threshold selection, and composite-risk weight configuration. Together, these components enable SOC teams, researchers, and risk managers to articulate AI-SOC risk in operational and quantitative terms: financial loss exposure, detection coverage, service-level performance, analyst capacity, model maintenance requirements, automation safety, and evidence-handling readiness. The framework is intended for research, teaching, and practical experimentation. All data in this package are synthetic. No operational SOC telemetry, incident record, or customer data was included or used. The default parameters are illustrative demonstration values, not benchmarks or recommendations. They should be recalibrated with organization-specific incident frequencies, loss estimates, detector scores, alert-arrival rates, analyst service times, drift observations, and evidence-retention requirements before being used for operational decision-making. Version 2 (August 2026) This version accompanies the revised manuscript submitted to the Journal of Cybersecurity and Privacy. It supersedes version 1 for the purpose of reproducing the article; version 1 remains published and citable. Version 1 code is correct and unchanged: running run_simulations.py still reproduces the exact same version 1 output. What version 1 lacked was a single authoritative statement of which numbers the article quotes. Some figures circulated with an earlier manuscript draft had been produced outside this toolkit and disagreed with the deposited outputs on Value-at-Risk, ROC-AUC, the selected decision threshold, and F1. Version 2 removes that ambiguity. Main changes in version 2: - run_article_outputs.py regenerates every article figure and every reported value in one pass from fixed seeds.- outputs/reported_values.csv lists each value together with the section or table of the article in which it appears. Any value in the manuscript that is not in that file should be treated as an error.- AI_SOC_Risk_Model.xlsx has been rebuilt to implement Equation (1) of the article, including the forensic-readiness term, the article’s weights, and the deployment-state bands.- The workbook reproduces the article’s composite risk scores: 0.402 for the baseline workflow and 0.350 for the proposed evidence-preserving workflow.- New workbook sheets cover forensic-readiness indicators, deployment-state decisions, gating constraints, and deposited simulation outputs.- Added analyses include a precision-recall curve, Monte Carlo loss sensitivity, weight-configuration sensitivity, queue sensitivity, Allen-Cunneen burstiness correction, and threshold-queue coupling. The authoritative values for the revised article are: - Mean annualized loss: USD 1.70M- 95% Value-at-Risk: USD 3.85M- 99% Value-at-Risk: USD 6.29M- 95% Tail-Value-at-Risk: USD 5.45M- 99% Tail-Value-at-Risk: USD 8.61M- Detector ROC-AUC: 0.942- Detector PR-AUC: 0.750- Selected threshold: 1.873- Precision / recall / F1: 0.719 / 0.650 / 0.683- Baseline analyst utilization: 0.962- AI-assisted analyst utilization: 0.775- MTTR baseline / AI-assisted: 44.3 minutes / 25.9 minutes- Drift SLA breaches: 20 of 52 weeks below the recall floor- Composite risk score, baseline workflow: 0.402, assisted triage- Composite risk score, proposed evidence-preserving workflow: 0.350, assisted triage To reproduce the article outputs: pip install -r requirements.txtpython run_article_outputs.py --outdir outputs The package is released under CC BY 4.0.