The literature presents a robust consensus on the increasing effectiveness of ML models in intrusion detection, malware analysis, and network traffic monitoring. Approaches based on convolutional neural networks (CNNs) and recurrent networks (RNNs) have demonstrated high accuracy in identifying anomalous patterns and suspicious behaviour, allowing near-real-time responses, and reducing exposure to complex attacks (Batool et al., 2025). At the same time, unsupervised learning and reinforcement learning techniques have been investigated to identify zero-day attacks, mitigating the dependence on static signatures and increasing the adaptability of systems in the face of volatile environments (Zoppi et al., 2021).

A recent evolution refers to the incorporation of AI in zero trust architectures, in which continuous validation and adaptive segmentation are reinforced by intelligent algorithms, expanding the ability to detect suspicious behaviour that escapes traditional mechanisms (Li et al., 2025). In addition, frameworks based on intelligent agents have been proposed for Security Operations Centres (SOCs), allowing automated prioritization of alerts and human decision support, reducing operational overhead, and balancing algorithmic autonomy with human oversight (Ismail et al., 2025; Srinivas et al., 2025).

Despite the advances, the literature identifies significant limitations. Reliance on large volumes of labelled data, which is essential for training trusted models, remains one of the biggest challenges, especially in environments where data privacy is critical (Liang et al., 2022). Another obstacle lies in the interpretability of complex models: deep networks behave like opaque systems, making it difficult to audit and justify automated decisions (Mulita, 2025; Tyagi et al., 2025). In response to these limitations, hybrid proposals emerge that combine AI with traditional threat intelligence, creating systems that are more robust, contextualised, and capable of operating in scenarios of uncertainty (Sarker, 2024; Spyros et al., 2025).

Contemporary literature indicates a progressive transition of AI from a predominantly reactive role to a predictive and strategic role in risk management (Li et al., 2024). AI-based decision support systems can analyse massive streams of data in real-time, correlate dispersed events, and prioritize vulnerabilities based on impact on critical assets. Technologies, such as Security Orchestration, Automation and Response (SOAR) integrate advanced algorithms that automate responses and consolidate alerts, significantly reducing incident response time and improving the allocation of human and technological resources (Ismail et al., 2025). In a complementary way, User and Entity Behaviour Analytics (UEBA) solutions use machine learning to build behavioural profiles and detect deviations that may signal internal or external threats, reinforcing the ability of organisations to anticipate and mitigate risks (Gupta et al., 2024).

The literature also emphasises that the strategic potential of AI depends on organisational factors, including digital maturity, governance infrastructure, and alignment between technology and internal processes. Other studies demonstrate that effective adoption of AI is intrinsically linked to the ability of organisations to integrate new systems into their decision architecture, adjusting policies, workflows, and compliance practices (Aakula & Saini, 2024). At the same time, several authors warn of the risk of over-reliance on automatisms, especially in contexts of high institutional sensitivity, where automated decisions can generate ethical, legal, or reputational implications (Mökander et al., 2021). In this sense, AI should be understood as a support for human intelligence, and not as a substitute, preserving the critical role of decision-makers in the interpretation, validation, and contextualization of algorithmic recommendations (Rodgers et al., 2023).

The literature indicates that AI integration affects cybersecurity decision processes through several interrelated functional mechanisms. First, intelligent automation of alerts and incident handling reduces cognitive load in operational decision-making environments, enabling security analysts to focus on higher-level analytical and strategic tasks rather than routine triage (Batool et al., 2025; Ismail et al., 2025; Srinivas et al., 2025). Second, AI-driven predictive analytics support risk-based prioritization, by structuring the evaluation of threats and vulnerabilities, which improves the allocation of security resources and strengthens mitigation planning (Li et al., 2024; Gupta et al., 2024). Third, anomaly detection models based on machine learning and deep learning enhance early identification of abnormal system behaviours, shortening response cycles and reducing exposure to rapidly evolving threats (Kumar & Gutierrez, 2025; Muneer et al., 2024; Zoppi et al., 2021). In addition, behavioural profiling approaches, such as User and Entity Behaviour Analytics (UEBA) enable context-sensitive interpretation of user actions, reinforcing insider threat detection and adaptive monitoring capabilities (Gupta et al., 2024; Spyros et al., 2025). Finally, AI-supported recommendation systems in Security Operations Centres introduce machine-generated options into decision workflows, shifting cybersecurity management from reactive response toward a more anticipatory and preventive posture (Ismail et al., 2025; Srinivas et al., 2025). These functional effects illustrate how AI reshapes not only technical operations but also the structure and tempo of organisational security decision-making.

Studies also show that the impact of AI on strategic decision-making depends on organisational maturity, robust governance, and integration with existing practices (Neiroukh et al., 2024).

To analytically anchor the discussion on the interaction between AI and organisational decisionmaking, it is useful to resort to established theoretical frameworks. Two are particularly relevant: the Human-in-the-Loop (HITL) model and the theories of organisational decision making.

The Human-in-the-Loop paradigm, applied to cybersecurity, postulates that the most effective systems are those that combine the speed and processing power of AI with contextual judgment, creativity, and the ethical responsibility of human beings (Sushant Kumar et al., 2024). This model does not see automation as a replacement, but as a symbiosis. AI acts as a cognitive amplifier, filtering out noise, identifying patterns, and suggesting actions, while the human analyst provides the domain expertise, understands organisational nuances, and takes ultimate accountability for the decision. This theoretical perspective helps explain why technical AI solutions, even the most precise ones, fail when they are not designed for smooth integration with existing human workflows and capabilities. In addition, organisational decision-making theories offer a lens to understand how AI challenges and transforms decision-making processes (Kaggwa et al., 2023). The classic rational model, which assumes complete information and a single objective of maximization, is insufficient to characterize cybersecurity environments, marked by uncertainty and multiple, sometimes conflicting objectives (Bokhari et al., 2022). AI aligns more closely with the model of Herbert Simon of bounded rationality, where decision-makers satisfy rather than optimize. Algorithms can expand these limits by processing more variables than a human could, thus providing a richer informational basis for more effective satisfaction (Khan, 2025). However, AI can also be framed in intuitive models, where machine learning systems identify subtle patterns and provide sensitivities or alerts that are not easily justifiable by linear logic, resembling an algorithmic intuition that must nevertheless be validated by human experience (Vouros, 2023).

Explainability emerges as one of the central themes in modern literature. Opaque models hinder transparency, auditing, and validation of results, compromising the confidence of analysts and managers (Arunraju Chinnaraju, 2025). Studies show that the acceptance of intelligent systems depends on the ability of users to understand algorithmic operation, interpret automated decisions, and reconcile technology with existing organisational practices (Vorm & Combs, 2022). The perception of autonomy, the clarity of the results presented, and the adequacy of the interfaces play decisive roles in the adoption of AI (Jocelyn Chew & Achananuparp, 2022).

Ethical and social issues also emerge as crucial elements. The literature highlights concern regarding algorithmic bias, personal data management, and automated decision accountabilities (Kordzadeh et al., 2022). Algorithmic bias poses a tangible threat to the fairness and effectiveness of safety decisions. For example, an insider threat detection system trained predominantly on user behaviour data from a specific technical department (e.g., IT) can learn to associate normalcy with nightly work patterns and access to administrative tools. When applied to the entire organisation, this model could generate false positives for employees in finance or marketing departments whose legitimate work patterns diverge from this learned normal, leading to unfair investigations, degradation of the work environment, and potential talent loss (Mubeen, 2024). This example illustrates how a biased training dataset can not only reduce technical accuracy but also incur ethical and management risks.

Over time and as organisations integrate AI into critical processes, it becomes imperative to establish robust governance policies, ongoing audit mechanisms, and regular training programs. Recent research suggests that the combination of AI-based decision models and human oversight increases organisational resilience, reduces systemic risks, and promotes greater reliability in decision-making (Zeriouh & Amara, 2025).

Table 1 systematises the critical factors identified in the literature, detailing their specific impact and proposing concrete risk mitigation strategies. This analytical structure allows visualisation of not only the challenges, such as the opacity of the models (black box) or the risks of algorithmic bias, but also the practical ways to overcome them, namely through the implementation of Explainable AI (XAI) or periodic audits. By organising these elements in a relational way, the table acts as a strategic guide to support the design, implementation, and governance of AI systems that are not only efficient, but also transparent, fair, and, therefore, trustworthy.

This table focuses specifically on governance, trust, and accountability mechanisms required to manage AI-related risks.

In summary, recent scientific production converges on the idea that AI is a transformative element in information security, providing substantial gains in accuracy, automation, and predictive capacity. The theoretical frameworks of HITL and organisational decision-making provide the conceptual lens to understand that its success is intrinsically linked to a symbiotic integration with the human element (Sushant Kumar et al., 2024). However, the same systems that increase efficiency introduce new challenges related to transparency, trust, governance, and accountability, where algorithmic bias stands out as a practical and ethical threat. The impact of AI on organisational decision-making is therefore conditioned by factors, such as digital maturity, organisational culture, ongoing human oversight, and ethical framework (Aakula & Saini, 2024). Despite this convergence on the benefits and challenges, the literature lacks studies that integrate these three dimensions, technical, decision-making, and human, in a single conceptual model, capable of guiding practical implementation in organisations. The present study aims to contribute to fill this gap, by proposing an integrated framework that will be detailed in subsequent sections. These gaps motivate the methodological approach described in the following section.

Figure 1 presents a conceptual model that illustrates the multidimensional impact of AI on information security and organisational decision-making. This model integrates the three central axes discussed throughout the review, AI-based threat detection, decision support and risk management, and human and trust factors, demonstrating their dynamic interdependence. The figure illustrates the interdependence between operational AI capabilities, decision-support functions, and human–governance factors. Rather than operating independently, these components form a feedback system in which technical outputs influence decision processes, which are in turn shaped by trust, oversight, and policy constraints. This visualisation emphasises that cybersecurity effectiveness emerges from alignment among these dimensions rather than from algorithmic performance alone. The gaps and the socio-technical complexity identified in the literature motivate the integrative methodological approach and are presented in the next section.

This study adopts an integrative literature review methodology. It was selected because the research problem spans technical, organisational, and ethical domains. Unlike systematic reviews focused on homogeneous empirical designs, integrative reviews enable the synthesis of conceptual, technical, and empirical studies, making them particularly suitable for examining socio-technical phenomena, such as AI-enabled cybersecurity decision-making. This approach allows the combination of performance-oriented research with governance and human-factor perspectives that would otherwise remain analytically disconnected.

The literature search was conducted across Scopus, IEEE Xplore, ScienceDirect, and SpringerLink. Searches used combinations of the keywords “artificial intelligence,” “cybersecurity,” “information security,” and “decision-making.” The review focused on studies published between 2021 and 2025 to capture recent developments in AI-enabled security.

Inclusion criteria:

Exclusion criteria:

Figure 2 summarizes the literature identification and selection process.

This figure demonstrates the progressive narrowing of the literature corpus, ensuring that the final sample reflects studies aligned with both technical and organisational dimensions of AI-enabled cybersecurity. The results of the analytical process are presented in the next section.

The results show that solutions based on machine learning and deep learning substantially improve the ability to detect threats and anomalies in corporate networks. Some empirical studies report reductions in response time of up to 40%; however, these findings are context-dependent and derived from heterogeneous operational environments. In addition, the use of supervised algorithms, such as Random Forest and Support Vector Machines, has been shown to be effective in analysing traffic and preventing intrusions (Kumar & Gutierrez, 2025; Muneer et al., 2024).

Figure 3 presents an analysis of the percentage distribution of the main application areas, based on the literature published between 2021 and 2025. This visualisation enables identification of dominant research priorities of the sector and the scientific community, revealing which areas have attracted the most attention and intellectual investment. The same figure also serves as a dynamic snapshot of the state of the art, offering an essential macro perspective to guide future technological developments and R&D resource allocation decisions.

The predominance observed in the domain of intrusion detection (34%), followed by malware and traffic analysis (22%) and risk management (18%), confirms the focus of the scientific community on operational applications that aim to increase the accuracy and efficiency of cyber defence mechanisms.

The second dimension is related to the role of AI in decision support and initiative-taking risk management. Tools, such as SOAR and UEBA, are being widely used to correlate alerts and prioritize vulnerabilities (Gupta et al., 2024; Ismail et al., 2025).

The automation of these processes has allowed security managers to shift the focus from reactive response to a preventive and strategic posture. However, some studies warn that blind trust in algorithmic recommendations can lead to biased or non-transparent decisions if the models are not auditable (Landers & Behrend, 2022).

Automated incident management tools, such as SOAR and UEBA, are demonstrating a measurable impact on prioritizing alerts and reducing false positives (ENISA, 2023). Reported improvements (30–40%) reflect specific case settings and should not be interpreted as generalisable performance benchmarks (Batool et al., 2025).

The third dimension highlights the role of human factors, trust, and explainability. The acceptance of AI systems by security professionals relies heavily on the ability to understand the reasons behind system decisions (Vorm & Combs, 2022). The literature emphasises the need for XAI to ensure that decision-makers maintain control and confidence over recommended actions (Arunraju Chinnaraju, 2025).

From an ethical point of view, the collection and processing of sensitive data to train AI models raises privacy concerns and algorithmic bias. The absence of transparency can compromise organisational accountability and generate significant reputational risks (Mökander et al., 2021). The analysis reveals that human and ethical factors are not a separate barrier, but rather the ground on which efficiency and decision support are built. As illustrated in Table 1, the mitigation strategy for explainability is the use of XAI. However, the technical implementation of XAI runs into a trade-off between precision and explainability: the most complex and accurate models, such as deep learning, are often the opaquest, while the most interpretable models, such as decision trees, can underperform. Thus, the choice of an AI model becomes a strategic decision that weighs the marginal gain in accuracy against the loss of transparency and the consequent erosion of team trust.

In an integrated way, the analysis confirms that AI plays a decisive role in the modernisation of organisational cybersecurity. Its effectiveness, however, depends on the balanced combination of technology and human oversight. The results indicate that success does not lie in unilaterally maximising one of the dimensions (e.g., efficiency), but in actively managing the inherent tensions between them. The organisations that gain the most operational resilience are those that recognise these trade-offs and integrate AI-driven cybersecurity with ethical governance, algorithmic auditing, and ongoing training, thus giving rise to a decision-making ecosystem, where the speed of AI is tempered by human judgment, its autonomy is counterbalanced by human control, and its complexity is made useful through explainability.

Beyond identifying thematic categories, the analysis revealed that most studies emphasise operational performance, while governance and human oversight dimensions remain comparatively underrepresented. This imbalance suggests that the technical maturity of AI applications is advancing faster than organisational and ethical integration frameworks, reinforcing the need for interdisciplinary approaches.

The reviewed literature consistently reports that AI improves intrusion detection accuracy, reduces false positives, and accelerates incident response. Machine learning and deep learning models enable faster identification of anomalous patterns, contributing to measurable efficiency gains (Kumar & Gutierrez, 2025).

Quantitative performance improvements reported in the literature vary substantially across contexts, datasets, and implementation conditions, and, therefore, indicate potential rather than standardized outcomes.

AI-based tools, such as Security Orchestration, Automation and Response (SOAR) and User and Entity Behaviour Analytics (UEBA) support decision-making by correlating alerts and prioritizing risks. These systems enable a shift from reactive responses to predictive and risk-based security strategies.

Trust and explainability emerge as critical factors for AI adoption. Blackbox models hinder accountability and user confidence, whereas explainable AI (XAI) techniques improve transparency and acceptance (Arunraju Chinnaraju, 2025). Ethical concerns include data privacy, algorithmic bias, and responsibility for automated decisions.

The proposed framework constitutes the conceptual outcome of the integrative synthesis, translating empirical and theoretical findings into an applied socio-technical model. Based on the synthesis, this study proposes a framework comprising three interdependent pillars: (1) technical efficiency, (2) trust and explainability, and (3) governance and accountability. At the centre lies contextualised human judgment, supported by continuous feedback between operational outcomes and governance mechanisms. Figure 4 shows a conceptual framework for this. The framework operationalises the study’s integrative contribution by translating literature synthesis into an implementable decision-governance structure. The findings are interpreted and contextualised in the Discussion section.