Explainable and Counterfactual Cyber-Threat Reasoning for Automated Security Operations: A Falsifiable Operationalization of Experience Architecture on AttackMate Traces

Security operations centers must transform heterogeneous event streams into defensible response decisions, yet intrusion detectors typically emphasize threat prediction rather than identifying which organized evidence actually changes the defensive response. We introduce EA-SOC, a falsifiable, counterfactual threat-reasoning architecture derived from Experience Architecture (EA). Its central novelty is to move beyond explaining why a model predicts a threat and instead test which evidence changes what the defender should do. Five enabling conditions—Difference, Availability, Orientation, Integration, and Temporality—are operationalized as transparent log-derived proxies, while Answerability is measured out of sample as the total-variation change in a three-action response field after evidence suppression. Evaluation uses two 2026 AttackMate scenarios with strict cross-scenario transfer and causal feature construction. The raw+EA random forest achieved mean AUROC 0.821, AUPRC 0.788, F1 0.550, false-positive rate 0.031, and Brier score 0.199, compared with 0.783, 0.746, 0.483, 0.081, and 0.211 for the raw-only random forest. Collapse tests remained falsifiable: removing Temporality reduced EA-only logistic AUROC from 0.665 to 0.568, while several other removals did not degrade discrimination. Counterfactual response sensitivity was largest for Orientation and Temporality. These results establish a reproducible proof of concept for response-oriented counterfactual cyber-threat reasoning, while not claiming general superiority or empirical validation of all EA constructs.