An ontology for ethical risk analysis in AI-Enabled SOAR systems

Abstract

Security Orchestration, Automation, and Response (SOAR) platforms have become increasingly important in cybersecurity operations by integrating heterogeneous security tools, automating repetitive tasks, and coordinat- ing incident response activities. More recently, Artificial Intelligence (AI) techniques have been incorporated into SOAR environments to improve alert triage, anomaly detection, prioritization, and response execution. Although this integration enhances operational scalability and analytical capacity, it also raises ethical issues in the development and use of this technology combination. Hence, a relevant research question arising from this combination is: what ethical issues arise from combining AI with SOAR, and how they are represented? To address this problem, this paper presents an ontology to represent ethical issues arising from the combination of AI with SOAR. The ontology is grounded in an Ontology Requirements Specification Document (ORSD) and modeled in OntoUML, a graphical ontology modeling language based on the Unified Foundational Ontology (UFO). The proposed task ontology organizes the domain’s structural and dynamic aspects into four views: technical infrastructure, operational processes, governance and supervision, and ethical consequences and risks. The state-of-the-art tools for OntoUML modeling support semi-automated ontology syntax verification and promote semantic interoperability by serializing the model into Semantic Web languages such as JSON and gUFO. The ontology model is evaluated through a critical analysis grounded in the principles of ontological modeling in OntoUML and the technical guidelines of Cybersecurity governance