Navigating identity threats in AI-enabled automated cyber defense: A dynamic model for modern SOC and vulnerability management teams

Security operations centers (SOCs) and vulnerability management (VM) are being progressively reconfigured by the increasing Artificial Intelligence (AI) enabled automation integration. While these changes enhance detection and response capabilities, they also trigger disruptions to the professional identity and trust dynamics of cybersecurity practitioners. Drawing on the identity threat appraisal theory and data from 46 interviews across 3 organizations, this study reveals 2 interrelated tensions: (1) role redefinition and (2) transparency and trust in AI-enabled automation. We develop a conceptual model called the dynamic identity work cycle that theorizes how cyber defense professionals balance these tensions through a continuous loop of threat appraisal, identity protection, identity restructuring, and validation. This research contributes to the field of organizational cybersecurity by uncovering the human mechanisms that support successful cyber defense operations in AI-enabled automation contexts. Our findings offer both a theoretical extension to organizational identity theory in high-tech work environments and practical insights for designing resilient AI integrated SOC and VM operations.