HUMAN COGNITIVE RESILIENCE IN SECURITY OPERATIONS CENTERS: A STRUCTURED REVIEW AND QUANTITATIVE FRAMEWORK FOR SLEEP, ALERT FATIGUE, WORKLOAD, AND HUMAN-AI CYBER DEFENSE

This review examines how sleep restriction, cumulative fatigue, alert overload, cognitive workload, occupational stress, burnout, and human-AI task allocation shape the cognitive conditions under which Security Operations Center (SOC) analysts and incident responders perform. The review updates and integrates evidence from cybersecurity, cognitive neuroscience, occupational psychology, human factors, and organizational resilience through August 2026. The synthesis distinguishes direct cybersecurity evidence from transferred evidence and identifies a persistent empirical gap: cyber operations clearly exhibit fatigue, workload, burnout, and alert-management pressure, but direct longitudinal evidence connecting objectively measured sleep and cognitive state to operational cyber outcomes remains limited. To move beyond a descriptive human-factors account, we refine the Human Cognitive Resilience Framework (HCRF) as a testable socio-technical model linking operational demands, cognitive load and occupational stress, organizational resources, cognitive resilience, cybersecurity performance, organizational cyber resilience, and organizational learning. The revised framework incorporates 2026 developments in human-centered cybersecurity and human-AI incident management, and introduces a quantitative operationalization for repeated-measures field testing. Recommended measurements combine sleep/actigraphy, psychomotor vigilance, workload and stress instruments, analyst telemetry, objective triage and response metrics, and organizational-resource indicators. Formal mediation, moderation, nonlinear threshold, and multilevel hypotheses are specified. The resulting framework treats human cognitive capacity neither as a substitute for technical controls nor as an individual responsibility problem, but as an operational resource jointly shaped by work design, staffing, recovery, automation, leadership, and team processes.