CLOSO Initiative

Explainable AI for Security Operations

CLOSO, short for Cognitive Load Optimized Security Operations, is the research framework behind Outershield's work on explainable, AI-assisted security operations, introduced in the paper below.

What Is CLOSO?

Human-AI collaboration, not black-box automation

SOC analysts are expected to triage a constant stream of security alerts while trusting the judgment of whatever automated system is filtering them. Most AI security tools make that harder, not easier: they flag threats without explaining why, which forces an analyst to either blindly trust the system or re-investigate everything it flags, defeating the point of automation.

CLOSO (Cognitive Load Optimized Security Operations) is Outershield's research framework for human-AI collaboration in security operations centers. Rather than treating AI as an opaque filter, it treats the analyst and the AI as collaborators: the AI augments the analyst's capacity to triage and investigate at scale, while staying explainable enough that the analyst can verify its reasoning instead of just accepting or overriding it outright. As stated in the founding paper, the goal is to optimize SOC analyst cognitive load, not just alert volume.

The framework is aimed at resource-constrained organizations specifically: critical-infrastructure-connected organizations and smaller financial institutions that cannot staff a 24/7 SOC team, and therefore need any automation they adopt to be trustworthy enough to run with minimal oversight.

CLOSO was introduced in the paper below, peer-reviewed in IRE Journals and since cited in ACM Transactions on Internet Technology. The forthcoming SHAP-LLM intrusion detection paper extends the same explainability approach to a specific detection task.

How CLOSO Works

Four components, each targeting a different source of cognitive load

Intelligent Alert Management

Prioritizes alerts by threat severity, organizational risk, and analyst availability, cutting alert volume while preserving high-fidelity threat indicators.

Contextual Intelligence Engine

Automatically enriches alerts with relevant context from threat intelligence and organizational data, reducing the cost of switching between tools.

Adaptive Workflow Orchestration

Distributes SOC tasks based on analyst expertise and current workload, balancing the team instead of overloading whoever is on shift.

Explainable Decision Support

Gives a clear, transparent reason for every AI-generated recommendation, so an analyst can verify it rather than just trust or reject it blindly.

What the Research Found

Results from 47 U.S. enterprise SOCs over 18 months

The founding paper evaluated CLOSO across 47 enterprise Security Operations Centers in the United States, spanning financial services, healthcare, critical infrastructure, technology, and government, over an 18-month implementation and evaluation period.

43%

Reduction in analyst cognitive load (p < 0.001), measured against baseline across all participating SOCs.

52%

Reduction in false positive alert rates, from 18.7% to 8.9% of total alerts.

38%

Faster mean time to detection, down from 127.4 to 78.9 minutes.

Figures are as reported in the founding paper's results (Section IV). Analyst retention across participating organizations also improved, from 87.4% to 95.3% annually.

CLOSO advances explainable AI security operations for resource-constrained U.S. organizations, prioritizing critical-infrastructure-connected organizations and smaller financial institutions.

Foundational Research

The Research Behind CLOSO

Explainable AI in Intrusion Detection for Resource-Constrained Organizations: A SHAP-LLM Framework with Adversarial Robustness Evaluation

Forthcoming

Chinemelum Umealajekwu

Forthcoming

Extends the CLOSO approach to intrusion detection, combining SHAP explanations with a language model so detection decisions are understandable without a dedicated security analyst on staff.

See the full Research & Publications page for all publications.