SAVIOR - AI-Supported Alert Validation for Industrial SOC Response

Purpose and goal

The purpose of the project is to strengthen Swedish industry’s digital resilience by developing AI support for SOC alert validation that requires customer communication. The goal is to reduce manual, time-critical, and fragmented work through two connected prototype modules: one for AI-supported alert validation and customer dialogue, and one for post-incident analysis and reporting.

Expected effects and result

The project is expected to deliver two integrated prototypes at TRL 5, tested in realistic SOC scenarios from industrial partners. Expected effects include shorter case handling time, higher-quality validation decisions, fewer unnecessary escalations, and more useful incident reports. In the long term, SAVIOR will support scalable SOC services, reuse of validation knowledge, stronger cybersecurity maturity, and increased competitiveness in the Swedish industry.

Planned approach and implementation

The project is carried out in six work packages: project management, requirements analysis and mapping of SOC workflows, development of the validation module, development of the post-incident module, integrated testing and evaluation, and dissemination. The work is based on design science, workshops, interviews, scenario-based testing, and close collaboration among JTH, the technology provider, the SOC operator, and SOC customers, each contributing with needs, data, and realistic scenarios.

External links

SAVIOR - AI-Supported Alert Validation for Industrial SOC Response