CoChat
Sign Up
Cited by 74Network Security and Intrusion DetectionInformation and Cyber SecurityDigital and Cyber Forensics

The DOI matches its Crossref record; 32 of the 33 references it cites were found in a registry or an index, and 1 are not checked yet.

Toward Robust Security Orchestration and Automated Response in Security Operations Centers with a Hyper-Automation Approach Using Agentic Artificial Intelligence

Open access
Ismail, Kurnia, Rahmat, Brata, Zilmas Arjuna, Nelistiani, Ghitha Afina, Heo, Shinwook, Kim, Hyeongon, Kim, Howon·2025·Information
DOI 10.3390/info16050365
Open this paper in CoChat — free accountOpen PDF

Abstract

The evolving landscape of cybersecurity threats demands the modernization of Security Operations Centers (SOCs) to enhance threat detection, response, and mitigation. Security Orchestration, Automation, and Response (SOAR) platforms play a crucial role in addressing operational inefficiencies; however, traditional no-code SOAR solutions face significant limitations, including restricted flexibility, scalability challenges, inadequate support for advanced logic, and difficulties in managing large playbooks. These constraints hinder effective automation, reduce adaptability, and underutilize analysts’ technical expertise, underscoring the need for more sophisticated solutions. To address these challenges, we propose a hyper-automation SOAR platform powered by agentic-LLM, leveraging Large Language Models (LLMs) to optimize automation workflows. This approach shifts from rigid no-code playbooks to AI-generated code, providing a more flexible and scalable alternative while reducing operational complexity. Additionally, we introduce the IVAM framework, comprising three critical stages: (1) Investigation, structuring incident response into actionable steps based on tailored recommendations, (2) Validation, ensuring the accuracy and effectiveness of executed actions, (3) Active Monitoring, providing continuous oversight. By integrating AI-driven automation with the IVAM framework, our solution enhances investigation quality, improves response accuracy, and increases SOC efficiency in addressing modern cybersecurity threats.

Overview

Integrity signals

Registry

Crossref · 10.3390/info16050365

Cites

32 of 33 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Citations

Cites

Show all 29 references

Research works printed but not linked: 18

  1. Zhang, Y., Li, X., and Wang, M. (2020, January 15–17). Playbook-Centric Scalable SOAR System Architecture. Proceedings of the 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security 2020), Dublin, Ireland.
  2. Sido, N., Emon, E.A., Ahmed, E., Supervisor, E., and Falch, M. (2024). Low/No Code Development and Generative AI. [Bachelor’s Thesis, Aalborg University]. Available online: https://vbn.aau.dk/ws/files/717521040/LowNOCode__GenAI.pdf.
  3. Desmond, M., Duesterwald, E., Isahagian, V., and Muthusamy, V. (2022). A No-Code Low-Code Paradigm for Authoring Business Automations Using Natural Language. arXiv.
  4. Rajput, A.S., and Professor, R.G.A. (2023). Hyper-automation-The next peripheral for automation in IT industries. arXiv.
  5. Quargnali, G. (2023). Low-Code/No-Code Development and Generative AI: Opportunities and Challenges. [Bachelor’s Thesis, Haaga-Helia University of Applied Sciences]. Available online: https://www.theseus.fi/bitstream/handle/10024/751688/Quargnali_Giovanni.pdf.
  6. Akande, A. (2024). The Psychology of Automation and Artificial Intelligence atWork: Exploring Four Fantasies and Their Leadership Implications. Power, Politics and Influence: Exercising Followership, Leadership, and Practicing Politics, Springer Nature.
  7. Kremer, R., Wudali, P.N., Momiyama, S., Araki, T., Furukawa, J., Elovici, Y., and Shabtai, A. (2023). IC-SECURE: Intelligent System for Assisting Security Experts in Generating Playbooks for Automated Incident Response. arXiv.
  8. Khan, R., Sarkar, S., Mahata, S.K., and Jose, E. (2024). Security Threats in Agentic AI System. arXiv.
  9. Kaheh, M., Kholgh, D.K., and Kostakos, P. (2023). Cyber Sentinel: Exploring Conversational Agents’ Role in Streamlining Security Tasks with GPT-4. arXiv.
  10. Bommasani, R., Hudson, D.A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M.S., Bohg, J., Bosselut, A., and Brunskill, E. (2021). On the Opportunities and Risks of Foundation Models. arXiv.
  11. Qin, Y., Liang, S., Ye, Y., Zhu, K., Yan, L., Lu, Y., Lin, Y., Cong, X., Tang, X., and Qian, B. (2023). ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs. arXiv, 16789.
  12. Wang, G., Lin, Z., Peng, J.B., Wu, Q., Lu, S., Gonzalez, J.E., Abbeel, P., and Zhou, D.S. (2023). Voyager: An Open-Ended Embodied Agent with Large Language Models. arXiv.
  13. Ahn, M., Brohan, A., Chai, Y.H.H., Canny, J., Goldberg, K., McGrew, B., and Ichter, B. (2022). Can Large Language Models Be an Alternative to Robot Motion Planning?. arXiv.
  14. Mitchell, 2022, The AI cybersecurity revolution: Leveraging autonomous decision-making for proactive threat mitigation, Cybersecur. J., 10, 45
  15. Singh, 2023, AI-driven cybersecurity orchestration: From predictive analytics to automated defenses, J. Artif. Intell. Cybersecur., 8, 112
  16. Zhou, 2022, AI-driven Vulnerability Assessment: Automating Risk Identification and Mitigation, J. Mach. Learn. Secur., 5, 189
  17. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv.
  18. Johnson, 2023, LLM-driven Adversarial Defense: Real-Time Detection and Mitigation of Adversarial Attacks, J. AI Secur. Res., 9, 155

Cited by

Sorted by citations

Related

See all

Metadata

Authors
Ismail, Kurnia, R., Brata, Z. A., Nelistiani, G. A., Heo, S., Kim, H., & Kim, H.
Affiliations
  • School of Computer Science and Engineering, Pusan National University, Busan 46241, Republic of Korea
  • SmartM2M. Co., Ltd., 701, 702, Building A, Centum Skybiz, 97 Centumjungang-ro, Haeundae-gu, Busan 48058, Republic of Korea
  • Pusan National University (KR)
Corresponding author
Kim, Howon
ORCID
Venue
Information
Publisher
MDPI AG
Published
2025-04-29
Volume
16
Issue
5
Pages
365
ISSN
2078-2489 (ISSN-L)
DOI
10.3390/info16050365
OpenAlex
W4409965657
Cited by
50
References
29
Citations by year
2026: 32 · 2025: 18
FWCI
20.99
Type
journal article
Language
en
Open access
Licence
Locations
  • Information (publishedVersion, cc-by)
  • Preprints.org (acceptedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
MSIT (Ministry of Science and ICT), Korea (RS-2020-II201797)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
Keywords
security orchestration, automation and response, security operations center, hyperautomation, agentic large language models, incident response, AI-generated code, incident investigation, active monitoring

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review