Cybersecurity operations center load balancing

A computer-implemented method for cybersecurity threat management, comprising:

• receiving, at a computer system, a notification of a new cybersecurity threat;
• executing, by a trained neural network, an analysis of the new cybersecurity threat to generate a probabilistic output, the probabilistic output indicating a confidence level for an automated assignment of the new cybersecurity threat;
• comparing, by one or more processors, the probabilistic output to a predetermined confidence threshold;
• in response to the probabilistic output exceeding the predetermined confidence threshold:
• identifying, by the trained neural network and based on the probabilistic output, a specific analyst;
• and
• automatically assigning the new cybersecurity threat to the specific analyst identified by the trained neural network;
• and
• in response to the probabilistic output not exceeding the predetermined confidence threshold, escalating the new cybersecurity threat for supervisory review.

A computer-implemented method for cybersecurity threat response, the method comprising:

• receiving, across a cybersecurity network from one or more cybersecurity threat protection applications, a notification of a new cybersecurity threat;
• in response to receiving the notification and prior to assigning the new cybersecurity threat to a human analyst, automatically executing, by a security operations automation component, one or more autonomic countermeasures to stabilize a system associated with the new cybersecurity threat;
• and
• after executing the one or more autonomic countermeasures, assigning the new cybersecurity threat to a specific human analyst based on an analyst threat response profile.

A cybersecurity workflow management system, comprising:

• a plurality of cybersecurity threat protection applications configured to generate threat notifications;
• a log concentrator configured to receive and normalize data from the plurality of cybersecurity threat protection applications;
• one or more processors;
• and
• a memory storing a trained neural network, which when executed by the one or more processors, configures the one or more processors to manage a cybersecurity workflow by analyzing input features derived from the normalized data and assigning a cybersecurity threat to a specific analyst based on an analyst threat response profile.