ARTIFICIAL INTELLIGENCE FOR PREDICTIVE CYBER THREAT DETECTION AND AUTOMATED INCIDENT RESPONSE IN SAUDI CRITICAL INFRASTRUCTURE

In Saudi Arabia, the digitalisation of energy, water, transport, communications, healthcare and government services is accelerating, making critical infrastructure more software-defined, interconnected and data-intensive. This convergence amplifies the value of artificial intelligence for cybersecurity but also alters the consequences of detection error; a false negative may enable disruptive activity to propagate across operational technology, while a false positive may trigger an unnecessary response that impacts physical operations. This review critically assesses the use of artificial intelligence in assisting predictive cyber threat detection and automatic incident response in Saudi critical infrastructure. It synthesises recent evidence on machine learning, deep learning, federated learning, cyber threat intelligence, adversarial robustness, recommender systems and response orchestration, interpreting these technologies through the operational constraints of industrial control systems and the governance expectations surrounding national critical assets. The review shows that the predictive value is highest when heterogeneous telemetry, asset context, and threat intelligence are fused, not when models classify isolated network records. It also finds that automation is most defendable as bounded autonomy: low risk, reversible actions can be performed automatically, and safety-critical containment requires confidence thresholds, human authorisation, and explicit rollback mechanisms.