Technology for security operations centers (SOCs) has a storied history of slow adoption due to concerns about trust and reliability. These concerns are amplified with artificial intelligence, particularly large language models (LLMs), which exhibit issues such as hallucinations and inconsistent outputs. To assess whether LLM-based tools can improve SOC efficiency, we embedded two PhD researchers within a multinational company SOC for six months of ethnographic fieldwork. We identified recurring challenges, such as repetitive tasks, fragmented/unclear data, and tooling bottlenecks, and collaborated directly with practitioners to develop LLM companion tools aligned with their operational needs. Iterative refinement reduced workflow disruption and improved interpretability, leading from skepticism to sustained adoption. Ethnographic analysis indicates that this shift was enabled by our sociotechnical co-creation process consistent with Nonaka's SECI model. This framework explains the common challenges in traditional SOC technology adoption, including workflow misalignment, rigidity against evolving threats and internal requirements, and stagnation over time. Our findings show that the co-creation approach can overcome these old barriers and create a new paradigm for creating usable technology for cybersecurity operations.

翻译：安全运营中心（SOC）的技术因信任和可靠性问题而长期面临采纳缓慢的困境。人工智能，特别是大语言模型（LLM）所展现的幻觉和不一致输出等问题加剧了这些担忧。为评估基于LLM的工具能否提升SOC效率，我们派遣两名博士研究员在一家跨国公司的SOC进行了为期六个月的人种学实地考察。我们识别出重复性任务、数据碎片化/不清晰以及工具瓶颈等反复出现的挑战，并与实践者直接合作开发符合其运营需求的LLM辅助工具。通过迭代优化，我们减少了工作流程干扰并提升了可解释性，从而将怀疑态度转变为持续采纳。人种学分析表明，这一转变得益于我们采用的社会技术共创过程，该过程符合野中郁次郎的SECI模型。该框架解释了传统SOC技术采纳中的常见挑战，包括工作流程错配、对不断变化的威胁和内部需求的僵化应对以及长期停滞。我们的研究表明，共创方法能够克服这些旧有障碍，并为网络安全运营创造可用技术建立新范式。