Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper reviews the application of Explainable Artificial Intelligence (XAI) in industrial cybersecurity, highlighting its significance in enhancing the transparency and interpretability of AI-driven systems within Security Operations Centers (SOCs). The authors analyze various XAI techniques, such as feature attribution methods and visualization techniques, while addressing the unique operational and regulatory challenges faced by industrial environments compared to traditional IT systems. Key findings reveal that despite the potential of XAI to improve trust and compliance, challenges like limited labeled datasets and explainability-performance tradeoffs remain critical hurdles for effective integration into SOC workflows.
XAI could be the key to unlocking trust in AI-driven cybersecurity, but significant hurdles like data limitations and explainability-performance tradeoffs still loom large.
The increasing digitalization of industrial infrastructure and the convergence of information technology (IT) and operational technology (OT) have expanded the cyberattack surface of industrial systems. To address the growing complexity of cyber threats, artificial intelligence (AI) and machine learning (ML) techniques are increasingly deployed within industrial cybersecurity operations, particularly in Security Operations Centers (SOCs). While these approaches improve anomaly detection, threat analysis, and automated response, their opaque decision-making presents challenges for operational trust, regulatory compliance, and incident response. EXplainable Artificial Intelligence (XAI) has emerged as a promising paradigm to improve the transparency and interpretability of AI-driven cybersecurity systems and decisions. This paper provides a comprehensive review of XAI techniques in industrial cybersecurity, focusing on industrial SOC environments and operational security workflows. We examine the role of AI in industrial SOC workflows, the types of operational data leveraged in industrial environments, and the benefits and limitations of AI-based threat detection. We then review major families of XAI approaches, including feature attribution methods, surrogate models, rule-based explanations, and visualization techniques, and analyze their applicability to industrial use cases. We further discuss the operational, regulatory, and safety requirements that distinguish industrial systems from traditional IT environments. Key challenges are examined, including limited labeled datasets, model reliability, explainability-performance tradeoffs, and the integration of XAI tools into SOC workflows. Finally, we identify open research directions and opportunities for developing trustworthy, operationally viable, and domain-specific XAI-enabled cybersecurity solutions for industrial environments.