APPLICATION OF EXPLAINED ARTIFICIAL INTELLIGENCE TO ASSESS INFORMATION SECURITY RISKS

Abstract

The article considers modern approaches to the analysis and assessment of information security risks with an emphasis on the application of artificial intelligence (AI) methods. A systematic review of classical qualitative, quantitative and hybrid risk management methods is conducted in the context of increasing complexity of cyber threats, dynamic changes in attack vectors and rapid adaptation of attackers. Based on the analysis of scientific literature, the need to transition from static procedures to adaptive models that rely on objective data and analytics and provide continuous monitoring, self-learning and operational updating of risk assessments is substantiated. Classes of intelligent methods are considered - expert intelligent systems, probabilistic-statistical models, neural network approaches, hybrid AI systems and behavioral analysis systems - their advantages, limitations and areas of application in the tasks of anomaly detection, incident forecasting and response automation. Special attention is paid to the role of explainable AI (XAI) in increasing the transparency of decision-making, the possibility of auditing models, and trust from users and regulators. Specific risks associated with the use of AI in cybersecurity are analyzed, in particular the vulnerability of intelligent systems themselves to specialized attacks, and directions for their mitigation through combined technical and organizational measures are proposed. Recommendations are given for the integration of AI components into educational programs for training cybersecurity specialists, which include the formation of competencies in the field of machine learning, interpretability of models, and safe deployment practices. Based on a comparative analysis, conceptual provisions are proposed for building an adaptive risk assessment method that combines automated threat detection, probabilistic assessment of consequences, and mechanisms for explaining results for making informed management decisions. To verify the method, five application scenarios were developed that allow testing the functional capability of the method in identifying hidden threats, ranking impact factors, and using it in training cases. The practical significance of the work lies in the formation of a methodological basis for the implementation of intelligent risk management systems in critical information infrastructures and organizations of various levels, as well as in determining the priorities of further research in the field of safe and transparent use of AI in cyberspace.