An AI-Driven Cloud Resilience and Cybersecurity Decision-Support Framework for Resilient U.S. Enterprise IT Operations

Abstract

Enterprise IT operations in the United States depend on hyperscale cloud regions, third-party services and an identity layer whose failures and compromises propagate quickly and are now reportable events. This article proposes an AI-driven cloud resilience and cybersecurity decision-support framework in which one telemetry pipeline, one set of calibrated models and one incident lifecycle serve both reliability and security incidents: a six-layer reference architecture, a state-machine lifecycle with timing metrics, and a workflow in which playbooks are ranked by expected loss and automated only under guardrails on confidence and blast radius. The framework is evaluated on a transparent synthetic testbed: a three-region estate of 46 services in a dependency graph with five third-party dependencies, eight disruption classes (zone and region outages, denial of service, ransomware intrusion, bad change, third-party failure, demand surge, compound event) and five operating strategies from manual reactive operations (S0) to AI detection with decision support and guarded automation (S4), with a gradient-boosted incident classifier, an anomaly scorer and a demand forecaster trained on synthetic histories. Over 20 fortnights per scenario, AI detection with decision support (S3) retains 9% of the manual strategy's weighted downtime summed over the disruption classes and 54% excluding ransomware, where it turns a multi-day serial restore into a contained incident in 85% of episodes; bad changes, denial-of-service attacks and compound events fall by 45 to 90% relative to rule-based operations through shorter decision latency and fewer wrong actions, while region outages are bounded by the single-region application tier rather than by the operating strategy. Guarded automation adds a small further gain at a measurable harm rate. One-factor sweeps of 20 parameters and a 120-draw Monte Carlo analysis identify the attacker's dwell and signal strength, the false-alarm budget, the decision latency and the recovery objectives as the drivers. All data are synthetic and the results depend on stated assumptions; the framework is mapped to NIST CSF 2.0, SP 800-61 Rev. 3, SP 800-160, zero trust and U.S. reporting rules, with a phased roadmap.