The DOI matches its Crossref record; 32 of the 33 references it cites were found in a registry or an index, and 1 are not checked yet.
Toward Robust Security Orchestration and Automated Response in Security Operations Centers with a Hyper-Automation Approach Using Agentic Artificial Intelligence
Open accessAbstract
The evolving landscape of cybersecurity threats demands the modernization of Security Operations Centers (SOCs) to enhance threat detection, response, and mitigation. Security Orchestration, Automation, and Response (SOAR) platforms play a crucial role in addressing operational inefficiencies; however, traditional no-code SOAR solutions face significant limitations, including restricted flexibility, scalability challenges, inadequate support for advanced logic, and difficulties in managing large playbooks. These constraints hinder effective automation, reduce adaptability, and underutilize analysts’ technical expertise, underscoring the need for more sophisticated solutions. To address these challenges, we propose a hyper-automation SOAR platform powered by agentic-LLM, leveraging Large Language Models (LLMs) to optimize automation workflows. This approach shifts from rigid no-code playbooks to AI-generated code, providing a more flexible and scalable alternative while reducing operational complexity. Additionally, we introduce the IVAM framework, comprising three critical stages: (1) Investigation, structuring incident response into actionable steps based on tailored recommendations, (2) Validation, ensuring the accuracy and effectiveness of executed actions, (3) Active Monitoring, providing continuous oversight. By integrating AI-driven automation with the IVAM framework, our solution enhances investigation quality, improves response accuracy, and increases SOC efficiency in addressing modern cybersecurity threats.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“These capabilities are coordinated by control loops, the most influential of which are ReAct (Yao S. et al., ICLR 2023 [89]), which interleaves natural-language reasoning with tool invocations [25]; plan-and-solve, which produces a complete plan before execution; and reflection, which critiques prior outputs before committing [28,32].”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [28]
In the citing paper
“And they raise governance questions about accountability when autonomous decisions cause harm [27,28].”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [28]
In the citing paper
“SOAR and threathunting surveys [27,28] focus on workflow automation rather than autonomous reasoning.”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [28]
In the citing paper
“First, action verification: an autonomous response that hallucinates a quarantine target is potentially catastrophic, so reflection passes and confidence thresholds gate execution [28].”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [28]
In the citing paper
“Rather than having one LLM plan, execute, and evaluate tasks, the systems now orchestrate a series of specialized agents sharing context, critiquing one another, and modularizing the incident-response pipeline [30], [31], [32].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [31]
Citations
Cites
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372
Chain-Of-Thought Prompting Elicits Reasoning in Large Language Models
Wei, J., Wang, X., Schuurmans, D., Bosma, M., Ichter, B., Xia, F., Chi, E., Le, Q. V., & Zhou, D. (2022) · Advances in Neural Information Processing Systems 35 · doi:10.52202/068431-1800 · Cited by 4,505
ProgPrompt: Generating Situated Robot Task Plans using Large Language Models
Singh, I., Blukis, V., Mousavian, A., Goyal, A., Xu, D., Tremblay, J., Fox, D., Thomason, J., & Garg, A. (2023) · 2023 IEEE International Conference on Robotics and Automation (ICRA) · doi:10.1109/icra48891.2023.10161317 · Cited by 613
AI Ethics: Integrating Transparency, Fairness, and Privacy in AI Development
Radanliev, P. (2025) · Applied Artificial Intelligence · doi:10.1080/08839514.2025.2463722 · Cited by 422
Smith, D., & Fischbacher, M. (2009) · Risk Management · doi:10.1057/rm.2009.1 · Cited by 173
AI/ML in Security Orchestration, Automation and Response: Future Research Directions
Kinyua, J. D. M., & Awuah, L. (2021) · Intelligent Automation & Soft Computing · doi:10.32604/iasc.2021.016240 · Cited by 126
Engel, C., Ebel, P., & Leimeister, J. M. (2022) · Electronic Markets · doi:10.1007/s12525-021-00519-7 · Cited by 86
Security Orchestration, Automation, and Response Engine for Deployment of Behavioural Honeypots
Bartwal, U., Mukhopadhyay, S., Negi, R., & Shukla, S. K. (2022) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/dsc54232.2022.9888808 · Cited by 52
APIRO: A Framework for Automated Security Tools API Recommendation
Sworna, Z. T., Islam, C., & Babar, M. A. (2022) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3512768 · Cited by 44
DERA: Enhancing large language model completions with dialog-enabled resolving agents
Nair, V., Schumacher, E., Tso, G., & Kannan, A. (2024) · Proceedings of the 6th Clinical Natural Language Processing Workshop · doi:10.18653/v1/2024.clinicalnlp-1.12 · Cited by 38
Research works printed but not linked: 18
- Zhang, Y., Li, X., and Wang, M. (2020, January 15–17). Playbook-Centric Scalable SOAR System Architecture. Proceedings of the 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security 2020), Dublin, Ireland.
- Sido, N., Emon, E.A., Ahmed, E., Supervisor, E., and Falch, M. (2024). Low/No Code Development and Generative AI. [Bachelor’s Thesis, Aalborg University]. Available online: https://vbn.aau.dk/ws/files/717521040/LowNOCode__GenAI.pdf.
- Desmond, M., Duesterwald, E., Isahagian, V., and Muthusamy, V. (2022). A No-Code Low-Code Paradigm for Authoring Business Automations Using Natural Language. arXiv.
- Rajput, A.S., and Professor, R.G.A. (2023). Hyper-automation-The next peripheral for automation in IT industries. arXiv.
- Quargnali, G. (2023). Low-Code/No-Code Development and Generative AI: Opportunities and Challenges. [Bachelor’s Thesis, Haaga-Helia University of Applied Sciences]. Available online: https://www.theseus.fi/bitstream/handle/10024/751688/Quargnali_Giovanni.pdf.
- Akande, A. (2024). The Psychology of Automation and Artificial Intelligence atWork: Exploring Four Fantasies and Their Leadership Implications. Power, Politics and Influence: Exercising Followership, Leadership, and Practicing Politics, Springer Nature.
- Kremer, R., Wudali, P.N., Momiyama, S., Araki, T., Furukawa, J., Elovici, Y., and Shabtai, A. (2023). IC-SECURE: Intelligent System for Assisting Security Experts in Generating Playbooks for Automated Incident Response. arXiv.
- Khan, R., Sarkar, S., Mahata, S.K., and Jose, E. (2024). Security Threats in Agentic AI System. arXiv.
- Kaheh, M., Kholgh, D.K., and Kostakos, P. (2023). Cyber Sentinel: Exploring Conversational Agents’ Role in Streamlining Security Tasks with GPT-4. arXiv.
- Bommasani, R., Hudson, D.A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M.S., Bohg, J., Bosselut, A., and Brunskill, E. (2021). On the Opportunities and Risks of Foundation Models. arXiv.
- Qin, Y., Liang, S., Ye, Y., Zhu, K., Yan, L., Lu, Y., Lin, Y., Cong, X., Tang, X., and Qian, B. (2023). ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs. arXiv, 16789.
- Wang, G., Lin, Z., Peng, J.B., Wu, Q., Lu, S., Gonzalez, J.E., Abbeel, P., and Zhou, D.S. (2023). Voyager: An Open-Ended Embodied Agent with Large Language Models. arXiv.
- Ahn, M., Brohan, A., Chai, Y.H.H., Canny, J., Goldberg, K., McGrew, B., and Ichter, B. (2022). Can Large Language Models Be an Alternative to Robot Motion Planning?. arXiv.
- Mitchell, 2022, The AI cybersecurity revolution: Leveraging autonomous decision-making for proactive threat mitigation, Cybersecur. J., 10, 45
- Singh, 2023, AI-driven cybersecurity orchestration: From predictive analytics to automated defenses, J. Artif. Intell. Cybersecur., 8, 112
- Zhou, 2022, AI-driven Vulnerability Assessment: Automating Risk Identification and Mitigation, J. Mach. Learn. Secur., 5, 189
- Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv.
- Johnson, 2023, LLM-driven Adversarial Defense: Real-Time Detection and Mitigation of Adversarial Attacks, J. AI Secur. Res., 9, 155
Cited by
Sorted by citations
Karras, A., Theodorakopoulos, L., Karras, C., Theodoropoulou, A., Kalliampakou, I., & Kalogeratos, G. (2025) · Information · doi:10.3390/info16110957 · Cited by 41
A Multi-Agent System for Cybersecurity Threat Detection and Correlation Using Large Language Models
Hmimou, Y., Tabaa, M., Khiat, A., & Hidila, Z. (2025) · IEEE Access · doi:10.1109/access.2025.3602681 · Cited by 25
Agentic AI in Hospitality and Tourism: Opportunities, Risks, and Research Pathways
Ali, F., & Ali, L. (2025) · Journal of Travel Research · doi:10.1177/00472875251392915 · Cited by 24
RedTeamLLM: An Agentic AI Framework for Offensive Security
Challita, B., & Parrend, P. (2026) · IFIP advances in information and communication technology · doi:10.1007/978-3-032-21184-2_26 · Cited by 22
Vinay, V. (2026) · 2026 IEEE 5th International Conference on AI in Cybersecurity (ICAIC) · doi:10.1109/icaic67076.2026.11395809 · Cited by 15
Metadata
- Authors
- Ismail, Kurnia, R., Brata, Z. A., Nelistiani, G. A., Heo, S., Kim, H., & Kim, H.
- Affiliations
- School of Computer Science and Engineering, Pusan National University, Busan 46241, Republic of Korea
- SmartM2M. Co., Ltd., 701, 702, Building A, Centum Skybiz, 97 Centumjungang-ro, Haeundae-gu, Busan 48058, Republic of Korea
- Pusan National University (KR)
- Corresponding author
- Kim, Howon
- Venue
- Information
- Publisher
- MDPI AG
- Published
- 2025-04-29
- Volume
- 16
- Issue
- 5
- Pages
- 365
- ISSN
- 2078-2489 (ISSN-L)
- OpenAlex
- W4409965657
- Cited by
- 50
- References
- 29
- Citations by year
- 2026: 32 · 2025: 18
- FWCI
- 20.99
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Information (publishedVersion, cc-by)
- Preprints.org (acceptedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- MSIT (Ministry of Science and ICT), Korea (RS-2020-II201797)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Keywords
- security orchestration, automation and response, security operations center, hyperautomation, agentic large language models, incident response, AI-generated code, incident investigation, active monitoring
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
