S10.10 - Cybersecurity

S10.10 ? Cybersecurity

flowchart LR
    A[Cybersecurity context
alert triage, incident response, threat intelligence] --> B[RAIDT
run-level evidence framework]
    H[Practical run fields
prompt, alert data, model settings, analyst review, timestamps] --> C[[Cybersecurity
domain playbook for AI-assisted security runs]]
    B --> C
    C --> D[Evidence pack]
    C --> E[RAIDT score profile]
    D --> F[Reviewer reconstruction
and contestability]
    E --> G[Governance readiness
and organisational learning]

? Star S10 - Empirical Programme, Domains and Sector Playbooks

Star context: Shows how RAIDT is tested and made operational in sector playbooks, with cybersecurity illustrating why high-tempo, high-consequence GenAI use requires run-level evidence rather than generic assurance alone.

Academic picture

Definition / background

In this item, cybersecurity refers to the domain-specific application of RAIDT to security operations and related organisational security work. It includes use cases such as alert triage, incident response support, threat-intelligence interpretation, control-explanation drafting, and stakeholder communication during security events. The concept matters because cybersecurity is a setting in which generative AI can be useful, but where weak accountability, opaque reasoning, or poor traceability can quickly turn into operational and governance failure.

Conceptually, cybersecurity here is not simply the broad field of protecting systems and data. Within RAIDT, it is a sector playbook domain used to test how responsible governance behaves when work is high-pressure, evidence-sensitive, and often contestable after the fact. That makes it different from a generic discussion of AI in cybersecurity, which may focus on performance, automation, or threat-detection capability without showing how one concrete AI-assisted action can later be reconstructed and assessed.

Cybersecurity belongs inside RAIDT because the framework treats the run as the unit of governance. In a security context, one run might be a GenAI-supported interpretation of an alert, a draft incident summary, a recommended severity label, or an explanation prepared for managers or auditors. What matters is not only whether the model appears useful in general, but whether that particular run can be evidenced, reviewed, challenged, and learned from.

The relationship to RAIDT's practical outputs is direct. A cybersecurity run can generate a run-level evidence pack containing the prompt, source artefacts, output, analyst intervention, and decision trail. That evidence then supports a five-pillar score profile across Responsibility, Auditability, Interpretability, Dependability, and Traceability. In this sense, cybersecurity provides a demanding but highly relevant domain for demonstrating why RAIDT moves governance from general claims toward reviewable organisational evidence.

Why this concept matters

Cybersecurity matters in RAIDT because it exposes a recurring governance problem: organisations may adopt GenAI tools in security workflows before they can reliably explain how specific outputs informed analysis, escalation, or communication. A domain playbook is therefore needed to prevent security use from being treated as if speed alone were sufficient evidence of appropriateness.

This concept also avoids confusion between technical efficacy and governance adequacy. A GenAI assistant might produce a plausible incident summary or a sensible-looking triage recommendation, yet still create governance risk if the reasoning cannot be inspected, the source basis is unclear, or the analyst's intervention is not recorded. Cybersecurity work is especially sensitive to these problems because the cost of misplaced trust can include delayed response, false escalation, missed compromise indicators, or weak post-incident accountability.

For organisations using GenAI, the item matters because it shows how domain-specific governance must be operationalised. RAIDT does not ask cybersecurity teams to rely on principles in the abstract. It asks whether one concrete AI-assisted security run can be reconstructed, scored, reviewed, and improved. That shift is what turns governance from aspiration into practice.

Key idea: Cybersecurity matters in RAIDT because security-critical GenAI use must be governable at the level of the individual run, not only approved in principle.

What this item enables

A domain-specific RAIDT playbook for AI-assisted security work such as alert triage, incident drafting, and threat interpretation.
Clear identification of which evidence must be captured when GenAI informs a cybersecurity judgement or communication.
More defensible review of whether a security output was accepted, challenged, edited, escalated, or rejected.
Comparison of governance quality across repeated security runs, teams, tools, or deployment settings.
Better linkage between security practice and RAIDT's evidence pack, score profile, and governance-readiness outcome.
More credible explanation to supervisors, reviewers, auditors, and practitioners of how RAIDT works in a high-consequence domain.

Practical example / likely audience question

Audience question

Why does RAIDT need a separate cybersecurity item when security teams already keep logs, incident tickets, and standard operating procedures?

Answer

The concern behind this question is that cybersecurity already appears heavily documented, so a domain-specific RAIDT treatment may seem redundant. The direct answer is that ordinary security artefacts do not automatically provide governance-ready evidence for one AI-assisted run. Logs may show events, tickets may record workflow progress, and procedures may describe expected practice, but those materials often do not capture the exact prompt, model configuration, generated recommendation, analyst intervention, and justification needed to review one GenAI-supported judgement.

Consider an analyst using a GenAI assistant to summarise suspicious endpoint behaviour and recommend whether an alert should be escalated as a probable ransomware incident. If the analyst later accepts the recommendation and the escalation proves mistaken, the key governance issue is not only whether the team had a policy for AI use. The issue is whether reviewers can reconstruct what evidence the model was given, what it produced, how the analyst relied on it, and whether the process met the organisation's required safeguards.

RAIDT handles this better than a generic AI governance approach because it binds the cybersecurity use case to the run. Instead of treating security AI adoption as a broad capability question, it asks whether each important run leaves sufficient evidence to justify a score profile and support reviewability, contestability, and learning. That is why the cybersecurity item is not redundant; it operationalises governance in a domain where decisions are fast, consequential, and frequently revisited after incidents.

Practical example in RAIDT terms

A security operations centre uses GenAI to support alert triage for potentially malicious PowerShell activity. The use case is legitimate: the model helps the analyst convert raw telemetry into a draft explanation, likely severity, and suggested next step. The run-level issue is whether the GenAI recommendation can be trusted enough to influence triage without obscuring the evidential basis of the decision.

The evidence needed includes the alert snapshot, relevant telemetry extracts, the prompt or instruction template, model and tool version, the generated interpretation, the analyst's edits, the final triage decision, escalation outcome, timestamps, and any follow-up review notes. Responsibility is affected because the organisation must show who remained accountable for the triage decision. Auditability is affected because another reviewer must be able to reconstruct the AI-assisted sequence. Interpretability is affected because the basis of the recommendation must be understandable enough for challenge. Dependability is affected because consistent and safe triage quality matters across repeated runs. Traceability is affected because the recommendation must be linked to the actual evidence, actor, and decision path.

This improves governance readiness because the organisation can examine a disputed triage event as a structured case rather than as an informal recollection. RAIDT thereby turns cybersecurity use from a vague claim that AI was "used responsibly" into a documented run that can be reviewed, scored, and used for process improvement.

Detailed link to RAIDT

Cybersecurity links to RAIDT in four ways.

First, it demonstrates RAIDT's core idea in a demanding operational domain where governance must withstand time pressure, uncertainty, and later scrutiny.
Second, it anchors the run as the practical unit of review for AI-assisted security tasks such as triage, response drafting, and stakeholder communication.
Third, it determines what domain-specific evidence enters the evidence pack and what justifies the RAIDT score profile for a cybersecurity run.
Fourth, it strengthens reviewability, contestability, audit readiness, and organisational learning by making security decisions reconstructable after the event.

Cybersecurity playbook ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

Cybersecurity therefore acts as a proof-of-use domain for RAIDT: it shows that the framework is not confined to abstract governance theory but can structure evidence and judgement in live organisational work.

Link to the five RAIDT pillars

Responsibility

Cybersecurity strongly affects Responsibility because AI-assisted security work still requires clear human ownership for decisions that may trigger escalation, containment, notification, or reassurance.