Cyber Resilience as an Organizational Outcome in the Age of AI - Explainability as a Means to Foster Adaptive Capacity

Explainable AI (XAI) has received growing attention the last years due to the growth of more sophisticated machine learning models. These modern models are often complex, and their internal workings are often challenging to explain, fuelling the interest in terms like explainability, interpretability and transparency. Although XAI is considered to be a highly multidisciplinary topic, and the explainability dimension of the concept implicitly point at the human recipient of the explanations, both the human and organizational perspective seems to be currently neglected in XAI research. This is highly problematic within the cyber security domain where cyber resilience is dependent on sociotechnical dimensions relating to both human as well as organizational aspects.
While AI is suggested to have big impacts on the cyber security domain, it is still undiscovered what role explainability of AI will have. This paper builds on a sociotechnical understanding of the XAI concept and draws on the theoretical perspective of adaptive capacity as fundamental in the understanding of cyber resilience. We combine these perspectives when we approach current literature on XAI in the context of cyber resilience, illustrating that XAI is mainly treated as a technical artefact, neglecting the human and organizational dimensions that are crucial to develop and foster adaptive capacity. We discuss the implications of this narrow view on XAI in the context of cyber resilience, suggesting future research avenues to be followed to fill the current gaps.

Keywords: Cyber resilience, Adaptive capacity, XAI, Explainable AI, Sociotechnical theory.