AI-Augmented SOC: A Survey of LLMs and Agents for Security Automation
Open accessAbstract
The increasing volume, velocity, and sophistication of cyber threats have placed immense pressure on modern Security Operations Centers (SOCs). Traditional rule-based and manual processes are proving insufficient, leading to alert fatigue, delayed responses, high false-positive rates, analyst dependency, and escalating operational costs. Recent advancements in Artificial Intelligence (AI) offer new opportunities to transform SOC workflows through automation and augmentation. Large Language Models (LLMs) and autonomous AI agents have shown strong potential in enhancing capabilities such as log summarization, alert triage, threat intelligence, incident response, report generation, asset discovery, and vulnerability management. This paper reviews recent developments in the application of LLMs and AI agents across these SOC functions, introducing a taxonomy that organizes their roles and capabilities within operational pipelines. While these technologies improve detection accuracy, response time, and analyst support, challenges persist, including model interpretability, adversarial robustness, integration with legacy systems, and the risk of hallucinations or data leakage. A detailed capability-maturity model outlines the levels of integration with SOC tasks. This survey synthesizes trends, identifies persistent limitations, and outlines future directions for trustworthy, explainable, and safe AI integration in SOC environments.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
SOAR and threat-hunting surveys [27,28] focus on workflow automation rather than autonomous reasoning.
“SOAR and threathunting surveys [27,28] focus on workflow automation rather than autonomous reasoning.”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [27]
The Introduction (page unavailable) describes this paper as a survey of LLM and AI-agent applications across SOC functions, not specifically a SOAR or threat-hunting survey. Its Capability Maturity Model section explicitly examines progression from manual to fully autonomous operations, including independent complex analysis. That contradicts the characterization that it focuses on workflow automation rather than autonomous reasoning. (LLM, conf=0.87)
Checked by a reasoning model — may be wrong.
Experimental — accuracy not yet measuredCyberAlly is reported to have cut MTTR from 8 h to 90 min (vendor case-study figures, not an independent benchmark) in simulated SOC environments.
“CyberAlly [27] is reported to have cut MTTR from 8 h to 90 min (vendor case-study figures, not an independent benchmark) in simulated SOC environments.”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [27]
Section 3.2, Alert Triage (page not specified), reports that CyberAlly was tested in simulated SOC environments and reduced Mean Time To Respond from 8 h to 90 min. The paper does not identify those figures as a vendor case study or establish whether they came from an independent benchmark; Section 7, Threats to Validity, gives only a general caution about simulated evaluations. (LLM, conf=0.87)
Experimental — accuracy not yet measuredGen-2 strength comes in joining natural language and the real data, but they are vulnerable to error drift and ripple-level logic failures that only their persistent monitoring can alleviate.
“Their strength comes in joining natural language and the real data, but they are vulnerable to error drift and ripple-level logic failures that only their persistent monitoring can alleviate [23], [29].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
The Log Summarization section describes LLMs turning collected log data into human-readable insights, while the Interpretability table warns of cascading errors from hallucinations. Section 5.3 (Model-Related Challenges) calls for continuous self-verification and human oversight. The paper does not establish these points specifically for “Gen-2,” describe error drift, or say that persistent monitoring is the only way to alleviate the failures. (LLM, conf=0.84)
Experimental — accuracy not yet measuredGen-1 provides a valuable but limited base: a strong linguistic intelligence coupled with structural weaknesses that stop reliable automation.
“Ultimately, Gen-1 provides a valuable but limited base: a strong linguistic intelligence coupled with structural weaknesses that stop reliable automation [23], [25].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
Section 5.3, “Model-Related Challenges” (page unavailable), describes LLM reliability weaknesses, including hallucinations and susceptibility to attacks, and says security operations often require human verification. The paper supports the contrast between useful language capabilities and reliability limits, but does not identify a “Gen-1” category or say those weaknesses stop reliable automation altogether. (LLM, conf=0.84)
Experimental — accuracy not yet measuredWhile models work in probability space and do not use external verification mechanisms, if the prompt is ambiguous or data is found missing, it hallucinates or misses crucial details.
“While models work in probability space and do not use external verification mechanisms, if the prompt is ambiguous or data is found missing, it hallucinates or misses crucial details [23], [25].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
The Interpretability table describes probabilistic output variability, and §5.5 says poor or inconsistent data can amplify hallucinations. Section 3.5 reports that autonomous LLMs often omit or hallucinate details. The paper does not establish that ambiguous prompts cause these errors or that models categorically lack external verification mechanisms; §5.3 instead discusses verification and oversight as ways to improve accuracy. (LLM, conf=0.85)
Experimental — accuracy not yet measured
Gen-2 agents significantly expand SOC capabilities, including semi-automated alert triage, log investigation, and contextual enrichment.
“Despite these constraints, Gen-2 agents significantly expand SOC capabilities, including semi-automated alert triage, log investigation, and contextual enrichment [23].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
Section 4 (Capability Maturity Model) describes Level 2 as semi-autonomous, including alert filtering and raw-log processing with human approval for critical cases. Sections 3.1 and 3.2 describe agent-assisted log analysis and contextual alert triage. The paper does not identify these capabilities as belonging to a category called “Gen-2 agents,” so that specific attribution is not established. (LLM, conf=0.82)
Experimental — accuracy not yet measuredEven when all tool calls correspond to the exact schema definitions, hallucinations might still arise in the agent's internal cognition that could guide the subsequent steps.
“Even when all tool calls correspond to the exact schema definitions, hallucinations might still arise in the agent's internal cognition that could guide the subsequent steps [23].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
The Interpretability section warns of cascading errors from hallucinations, and §5.3 describes LLM hallucinations as a reliability problem. These passages support the possibility that hallucinations affect later steps, but they do not address whether this can happen when every tool call conforms to its exact schema. (LLM, conf=0.83)
Experimental — accuracy not yet measuredAutonomous agents that handle sensitive log data, user identity data, and internal telemetry risk potential data leakage and privacy violations when they operate unmonitored.
“Prior work has highlighted the risk of potential data leakage and privacy violations when such systems operate unmonitored [23].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
The SOC Integration table warns that multi-agent systems risk sensitive-data exfiltration, and §5.4 identifies unintended exposure of sensitive information as a privacy concern. Section 5.2 calls for human oversight, but the copy does not specifically link operating unmonitored to data leakage or identify user identity data as part of that risk. The cited paper supports the general warning, not all of its stated conditions and details. (LLM, conf=0.82)
Experimental — accuracy not yet measuredAgentic systems raise ethical and privacy concerns because they access sensitive log records, internal telemetry, and individual user information.
“Agentic systems also raise ethical and privacy concerns due to their access to sensitive log records, internal telemetry, and individual user information, highlighting the need for data governance to avoid bias, prevent data leakage, and maintain accountability [23].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
Section 5.4 (Data-Related Challenges; page not provided) identifies logs and telemetry as security data and warns that generative AI may expose sensitive information. Sections 5.1 and 5.5 also discuss data leakage and the need for governance and accountability. The copy does not specifically say that agents access individual user information or tie that access to the stated privacy concerns. (LLM, conf=0.83)
Experimental — accuracy not yet measuredGen-2 systems partially address Gen-1 limitations by introducing multi-step planning through tool invocation, enabling automated log search and MITRE TTP lookup, but they still lack long-term memory and consistent reproducibility.
“Gen-2 systems partially address these limitations by introducing multi-step planning through tool invocation, enabling automated log search and MITRE TTP lookup; however they still lack long-term memory and consistent reproducibility [23].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
Section 3.1 (Log Summarization; page unavailable) says agentic frameworks extend LLMs with tool use and planning, and Section 3.3 (Threat Intelligence; page unavailable) describes identifying MITRE ATT&CK techniques. The paper does not establish the claimed “Gen-2” category, automated log search and MITRE TTP lookup through tool invocation, or a Gen-2-specific lack of long-term memory and reproducibility. Section 3.1 instead describes memory as a capability of agentic frameworks. (LLM, conf=0.78)
Experimental — accuracy not yet measuredAI-Augmented SOC surveys [27,54] cover agent-based SOC automation in detail but are oriented toward enterprise networks rather than IoT edge constraints.
“AI-Augmented SOC surveys [27,54] cover agent-based SOC automation in detail but are oriented toward enterprise networks rather than IoT edge constraints.”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [27]
Agents raise governance questions about accountability when autonomous decisions cause harm.
“And they raise governance questions about accountability when autonomous decisions cause harm [27,28].”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [27]
CyberAlly halved false positives from 70% to 35% and cut MTTR from 8 h to 90 min in simulated SOC environments.
“CyberAlly halved false positives from 70% to 35% (still high by SOC production standards, but a substantial relative improvement) and cut MTTR from 8 h to 90 min in simulated SOC environments [27].”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [27]
Architectures including ReAct and Planner-Executor present a structured loop where the agent reasons over iterated steps, selects an action, executes a call to tools, observes results, and updates its internal plan.
“Architectures including ReAct and Planner-Executor present a structured loop where the agent reasons over iterated steps, selects an action, executes a call to tools, observes results, and updates its internal plan [23].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
The Alert Triage passage says LLMs enhance planning, and §3.5 Incident Response describes collaborative reasoning, but neither describes the claimed action–tool–observation loop. Searches for “ReAct,” “Planner-Executor,” and plan updates after tool execution found no passage in our copy addressing those architectures or their steps. (LLM, conf=0.72)
Experimental — accuracy not yet measuredThese schemas are instantiated as JSON contracts, function call interfaces, or domain-specific APIs ensuring predictable syntax and well-defined outputs for every agent-to-tool exchange.
“These schemas are instantiated as JSON contracts, function call interfaces, or domain-specific APIs ensuring predictable syntax and well-defined outputs for every agent-to-tool exchange [23].”
From The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines (2026) · cites this paper as [23]
Section 5.1 (Integration Challenges; page unavailable) discusses APIs and interoperability protocols, but does not describe schemas instantiated as JSON contracts, function-call interfaces, or domain-specific APIs. Searches for those terms and for predictable agent-to-tool outputs found no passage addressing the claimed guarantee for every exchange. (LLM, conf=0.74)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
The PRISMA 2020 statement: An updated guideline for reporting systematic reviews
Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., Shamseer, L., Tetzlaff, J. M., Akl, E. A., Brennan, S. E., et al. (2021) · BMJ · doi:10.1136/bmj.n71 · Cited by 108,283 · see citing works
From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacy
Gupta, M., Akiri, C., Aryal, K., Parker, E., & Praharaj, L. (2023) · IEEE Access · doi:10.1109/access.2023.3300381 · Cited by 714 · see citing works
Automatic Root Cause Analysis via Large Language Models for Cloud Incidents
Chen, Y., Xie, H., Ma, M., Kang, Y., Gao, X., Shi, L., Cao, Y., Gao, X., Fan, H., Wen, M., et al. (2024) · Proceedings of the Nineteenth European Conference on Computer Systems · doi:10.1145/3627703.3629553 · Cited by 190 · see citing works
LLMParser: An Exploratory Study on Using Large Language Models for Log Parsing
Ma, Z.-Y., Chen, A.-R., Kim, D. J., Chen, T., & Wang, S.-W. (2024) · International Conference on Software Engineering · doi:10.1145/3597503.3639150 · Cited by 151 · see citing works
LILAC: Log Parsing using LLMs with Adaptive Parsing Cache
Jiang, Z., Liu, J., Chen, Z., Li, Y., Huang, J., Huo, Y., He, P., Gu, J., & Lyu, M. R.-T. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3643733 · Cited by 148 · see citing works
Exploring LLM-Based Agents for Root Cause Analysis
Roy, D., Zhang, X., Bhave, R., Bansal, C., Las-Casas, P., Fonseca, R., & Rajmohan, S. (2024) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3663529.3663841 · Cited by 113 · see citing works
Khayat, M., Barka, E., Adel Serhani, M., Sallabi, F., Shuaib, K., & Khater, H. M. (2025) · IEEE Access · doi:10.1109/access.2025.3532951 · Cited by 76 · see citing works
Hassanin, M., & Moustafa, N. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2405.14487 · Cited by 75 · see citing works
Benchmarking Large Language Models for Log Analysis, Security, and Interpretation
Karlsen, E., Luo, X., Zincir-Heywood, N., & Heywood, M. (2024) · Journal of Network and Systems Management · doi:10.1007/s10922-024-09831-x · Cited by 71 · see citing works
Towards Human-AI Teaming to Mitigate Alert Fatigue in Security Operations Centres
Chhetri, M. B., Tariq, S., Singh, R., Jalalvand, F., Paris, C. L., & Nepal, . (2024) · ACM Transactions on Internet Technology · doi:10.1145/3670009 · Cited by 70 · see citing works
Interpretable Online Log Analysis Using Large Language Models with Prompt Strategies
Liu, Y., Tao, S., Meng, W., Wang, J., Ma, W., Chen, Y., Zhao, Y., Yang, H., & Jiang, Y. (2024) · IEEE International Conference on Program Comprehension (ICPC) · doi:10.1145/3643916.3644408 · Cited by 68 · see citing works
LogParser-LLM: Advancing Efficient Log Parsing with Large Language Models
Zhong, A., Mo, D., Liu, G., Liu, J., Lu, Q., Zhou, Q., Wu, J., Li, Q., & Wen, Q. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671810 · Cited by 66 · see citing works
Actionable Cyber Threat Intelligence Using Knowledge Graphs and Large Language Models
Fieblinger, R., Alam, T., & Rastogi, N. (2024) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw61312.2024.00018 · Cited by 66 · see citing works
CTIBench: A Benchmark for Evaluating LLMs in Cyber Threat Intelligence
Alam, T., Bhusal, D., Nguyen, L., & Rastogi, N. (2024) · neural information processing systems · doi:10.52202/079017-1607 · Cited by 59 · see citing works
Alert Prioritisation in Security Operations Centres: A Systematic Survey on Criteria and Methods
Jalalvand, F., Chhetri, M. B., Nepal, ., & Paris, C. L. (2024) · ACM Computing Surveys · doi:10.1145/3695462 · Cited by 58 · see citing works
Assess and Summarize: Improve Outage Understanding with Large Language Models
Jin, P., Zhang, S., Ma, M., Li, H., Kang, Y., Li, L., Liu, Y., Qiao, B., Zhang, C., Zhao, P., et al. (2023) · Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3611643.3613891 · Cited by 50 · see citing works
LogPrécis: Unleashing language models for automated malicious log analysis
Boffa, M., Drago, I., Mellia, M., Vassio, L., Giordano, D., Valentim, R., & Houidi, Z. B. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103805 · Cited by 47 · see citing works
Ali, T., & Kostakos, P. (2023) · arXiv · doi:10.48550/arxiv.2309.16021 · Cited by 47
Kalakoti, R., Vaarandi, R., Bahşi, H., & Nõmm, S. (2025) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0013180700003899 · Cited by 44 · see citing works
A Holistic View of AI-driven Network Incident Management
Hamadanian, P., Arzani, B., Fouladi, S., Kakarla, S. K. R., Fonseca, R., Billor, D., Cheema, A., Nkposong, E., & Chandra, R. (2023) · ACM Workshop on Hot Topics in Networks (HotNets) · doi:10.1145/3626111.3628176 · Cited by 41 · see citing works
Loumachi, F. Y., Ghanem, M. C., & Ferrag, M. A. (2025) · Computers · doi:10.3390/computers14020067 · Cited by 40 · see citing works
AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generation
Perrina, F., Marchiori, F., Conti, M., & Verde, N. V. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386116 · Cited by 36 · see citing works
LocalIntel: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge
Mitra, S., Neupane, S., Chakraborty, T., Mittal, S., Piplai, A., Gaur, M., & Rahimi, S. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-87496-3_5 · Cited by 35 · see citing works
LProtector: An LLM-driven Vulnerability Detection System
Sheng, Z., Wu, F., Zuo, X., et al. (2024) · arXiv.org · doi:10.48550/arxiv.2411.06493 · Cited by 34
Flow-of-action: SOP-enhanced LLM-based multi-agent system for root cause analysis
Pei, C., Wang, Z., Liu, F., Li, Z., Liu, Y., He, X., Kang, R., Zhang, T., Chen, J., Li, J., et al. (2025) · Companion Proceedings of the ACM on Web Conference 2025 · doi:10.1145/3701716.3715225 · Cited by 33 · see citing works
X-Lifecycle Learning for Cloud Incident Management using LLMs
Goel, D., Husain, F., Singh, A., Ghosh, S., Parayil, A., Bansal, C., Zhang, X., & Rajmohan, S. (2024) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3663529.3663861 · Cited by 33 · see citing works
LLM Agentic Workflow for Automated Vulnerability Detection and Remediation in Infrastructure-as-Code
Toprani, D., & Madisetti, V. K. (2025) · IEEE Access · doi:10.1109/access.2025.3560911 · Cited by 32 · see citing works
Nguyen, H. C., Tariq, S., Chhetri, M. B., & Vo, Q. B. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3701716.3715469 · Cited by 31 · see citing works
Daniel, N., Kaiser, F. K., Giladi, S., Sharabi, S., Moyal, R., Shpolyansky, S., Murillo, A., Elyashar, A., & Puzis, R. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9020023 · Cited by 29 · see citing works
Bridging Automated to Autonomous Cyber Defense
Applebaum, A., Dennler, C., Dwyer, P., Moskowitz, M., Nguyen, H., Nichols, N., Park, N., Rachwalski, P., Rau, F., Webster, A., et al. (2022) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/3560830.3563732 · Cited by 29 · see citing works
AECR: Automatic attack technique intelligence extraction based on fine-tuned large language model
Chen, M., Zhu, K., Lu, B., Li, D., Yuan, Q., & Zhu, Y. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104213 · Cited by 29 · see citing works
Fayyazi, R., Taghdimi, R., & Yang, S. (2023) · 2024 Annual Computer Security Applications Conference Workshops (ACSAC Workshops) · doi:10.1109/acsacw65225.2024.00036 · Cited by 28 · see citing works
The Rise of Cognitive SOCs: A Systematic Literature Review on AI Approaches
Binbeshr, F., Imam, M., Ghaleb, M., Hamdan, M., Rahim, M. A., & Hammoudeh, M. A. A. (2025) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2025.3536800 · Cited by 27 · see citing works
Multi-Agent Collaboration Mechanisms: A Survey of LLMs
Tran, K.-T., Dao, D., Nguyen, M.-D., Pham, Q.-V., O'Sullivan, B., & Nguyen, H. D. (2025) · arXiv · doi:10.48550/arxiv.2501.06322 · Cited by 26 · see citing works
Cheng, Y., Bajaber, O., Tsegai, S. A., Song, D. X., & Gao, P. (2025) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp63326.2025.00057 · Cited by 25 · see citing works
Fayyazi, R., Taghdimi, R., & Yang, S. J. (2024) · arXiv · doi:10.48550/arxiv.2401.00280 · Cited by 25
CYGENT: A cybersecurity conversational agent with log summarization powered by GPT-3
Balasubramanian, P., Seby, J., & Kostakos, P. (2024) · International Conference on Artificial Intelligence for Internet of Things (AIIoT) · doi:10.1109/aiiot58432.2024.10574658 · Cited by 24 · see citing works
Wang, D., Zhou, G., Chen, L., Li, D., & Miao, Y. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690231 · Cited by 23 · see citing works
AI-Driven Guided Response for Security Operation Centers with Microsoft Copilot for Security
Freitas, S., Kalajdjieski, J., Gharib, A., & McCann, R. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3701716.3715209 · Cited by 23 · see citing works
LibreLog: Accurate and Efficient Unsupervised Log Parsing Using Open-Source Large Language Models
Ma, Z., Kim, D. J., & Chen, T.-H. P. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00103 · Cited by 23 · see citing works
Towards a High Fidelity Training Environment for Autonomous Cyber Defense Agents
Oesch, S., Chaulagain, A., Weber, B., Dixson, M., Sadovnik, A., Roberson, B., Watson, C., & Austria, P. (2024) · Cyber Security Experimentation and Test Workshop (CSET) · doi:10.1145/3675741.3675752 · Cited by 22 · see citing works
Generative AI for Software Security Analysis: Fundamentals, Applications, and Challenges
Ding, A., Li, G., Yi, X., Lin, X., Li, J., & Zhang, C. (2024) · IEEE Software · doi:10.1109/ms.2024.3416036 · Cited by 21 · see citing works
Artificial Intelligence for Cybersecurity: A State of the Art
Siam, A. A., Hassan, M. M., & Bhuiyan, T. (2025) · IEEE International Conference on AI in Cybersecurity (ICAIC) · doi:10.1109/icaic63015.2025.10848980 · Cited by 19 · see citing works
Large Language Models are Autonomous Cyber Defenders
Castro, S. R., Campbell, R., Lau, N., Villalobos, O., Duan, J., & Cárdenas, Á. A. (2025) · IEEE Conference on Artificial Intelligence (CAI) · doi:10.1109/cai64502.2025.00195 · Cited by 19 · see citing works
Jin, H., Papadimitriou, G., Raghavan, K., Zuk, P., Balaprakash, P., Wang, C., Mandal, A., & Deelman, E. (2024) · International Conference for High Performance Computing, Networking, Storage and Analysis (SC) · doi:10.1109/sc41406.2024.00098 · Cited by 18 · see citing works
Research on the LLM-Driven Vulnerability Detection System Using LProtector
Sheng, Z., Wu, F., Zuo, X., Li, C., Qiao, Y., & Lei, H. (2024) · IEEE International Conference on Data Science and Computer Application (ICDSCA) · doi:10.1109/icdsca63855.2024.10859408 · Cited by 17 · see citing works
Malware Detection at the Edge with Lightweight LLMs: A Performance Evaluation
Rondanini, C., Carminati, B., Ferrari, E., Kundu, A., & Gaudiano, A. (2025) · ACM Transactions on Internet Technology · doi:10.1145/3769681 · Cited by 16 · see citing works
IntellBot: Retrieval Augmented LLM Chatbot for Cyber Threat Knowledge Delivery
Arikkat, D. R., Abhinav, M., Binu, N., Parvathi, M., Biju, N., Arunima, K. S., Vinod, P., A., R. R. K., & Conti, M. (2024) · International Conference on Computational Intelligence and Communication Networks (CICN) · doi:10.1109/cicn63059.2024.10847404 · Cited by 14 · see citing works
LLexus: an AI agent system for incident management
Las-Casas, P., Kumbhare, A. G., Fonseca, R., & Agarwal, S. (2024) · ACM SIGOPS Operating Systems Review · doi:10.1145/3689051.3689056 · Cited by 14 · see citing works
Chigurupati, M., Malviya, R. K., Toorpu, A. R., & Anand, K. (2025) · IEEE International Conference on AI in Cybersecurity (ICAIC) · doi:10.1109/icaic63015.2025.10849322 · Cited by 13 · see citing works
Pașca, E. M., Delinschi, D., Erdei, R., & Matei, O. (2025) · IEEE Access · doi:10.1109/access.2025.3554960 · Cited by 12 · see citing works
IRCopilot: Automated Incident Response with Large Language ModelsPreprint
Lin, X., Zhang, J., Deng, G., Liu, T., Zhang, T., Guo, Q., & Chen, R. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2505.20945 · Cited by 12 · see citing works
AutoBnB: Multi-Agent Incident Response with Large Language Models
Liu, Z. (2025) · 2025 13th International Symposium on Digital Forensics and Security (ISDFS) · doi:10.1109/isdfs65363.2025.11012055 · Cited by 11 · see citing works
TickIt: Leveraging Large Language Models for Automated Ticket Escalation
Liu, F., He, X., Zhang, T., Chen, J., Li, Y., Yi, L.-H., Zhang, H., Wu, G., & Shi, R. (2025) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3696630.3728558 · Cited by 11 · see citing works
Liu, X., Liang, J., Yan, Q., Jang, J., Mao, S., Ye, M., Jia, J., & Xi, Z. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2502.20791 · Cited by 11 · see citing works
Multi-Agent Collaboration in Incident Response with Large Language ModelsPreprint
Liu, Z. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2412.00652 · Cited by 11 · see citing works
Wang, X., Tian, Y., Huang, K., & Liang, B. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104113 · Cited by 10 · see citing works
Agentic Artificial Intelligence for Cyber Threat Management
Kshetri, N., & Voas, J. (2025) · Computer · doi:10.1109/mc.2025.3544797 · Cited by 9 · see citing works
AI Enhanced Ticket Management System for optimized Support
Jain, S., Gupta, A., & Neha, K. (2024) · International Conference on AI-ML Systems (AIMLSystems) · doi:10.1145/3703412.3703433 · Cited by 9 · see citing works
Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
Zhang, H., Huang, J., Mei, K., Yao, Y., Wang, Z., Zhan, C., Wang, H., & Zhang, Y. (2024) · arXiv · doi:10.48550/arxiv.2410.02644 · Cited by 9 · see citing works
Evaluating Large Language Models in Vulnerability Detection Under Variable Context Windows
Lin, J., & Mohaisen, A. (2024) · International Conference on Machine Learning and Applications · doi:10.1109/icmla61862.2024.00173 · Cited by 8 · see citing works
CTIBench: A Benchmark for Evaluating LLMs in Cyber Threat IntelligencePreprint
Alam, T., Bhusal, D., Nguyen, L., et al. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2406.07599 · Cited by 8 · see citing works
Alnahdi, A., & Narain, S. (2024) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa62245.2024.00020 · Cited by 7 · see citing works
Software Vulnerability and Functionality Assessment using LLMs
Jensen, R. I. T., Tawosi, V., & Alamir, S. (2024) · arXiv · doi:10.48550/arxiv.2403.08429 · Cited by 7 · see citing works
CyberAlly: Leveraging LLMs and Knowledge Graphs to Empower Cyber Defenders
Kim, M., Wang, J., Moore, K., Goel, D., Wang, D., Mohsin, A., Ibrahim, A., Doss, R., Camtepe, S. A., & Janicke, H. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3701716.3715171 · Cited by 6 · see citing works
Automatic Root Cause Analysis via Large Language Models for Cloud IncidentsPreprint
Chen, Y., Xie, H., Ma, M., et al. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2305.15778 · Cited by 6 · see citing works
Bountakas, P., Fysarakis, K., Kyriakakis, T., Karafotis, P. A., Sotiropoulos, A., Tasouli, M., Alcaraz, C., Alexandris, G., Andronikou, V., Koutsouri, T., et al. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3669924 · Cited by 6 · see citing works
Sharma, A. N., Akbar, K. A., Thuraisingham, B. M., & Khan, L. R. (2025) · ACM International Workshop on Security and Privacy Analytics (IWSPA) · doi:10.1145/3716815.3729012 · Cited by 5 · see citing works
On Automating Security Policies with Contemporary LLMs (Short Paper)
Saura, P. F., Jayaram, K. R., Isahagian, V., Bernabé, J. B., & Skarmeta, A. (2025) · 2025 IEEE International Conference on Software Services Engineering (SSE) · doi:10.1109/sse67621.2025.00018 · Cited by 5 · see citing works
Addressing Data Poisoning and Model Manipulation Risks using LLM Models in Web Security
Shah, S. P., & Deshpande, A. V. (2024) · International Conference on Distributed Systems, Computer Networks and Cybersecurity (ICDSCNC) · doi:10.1109/icdscnc62492.2024.10941696 · Cited by 4 · see citing works
Linking Threat Agents to Targeted Organizations: A Pipeline for Enhanced Cybersecurity Risk Metrics
Massengale, S., & Huff, P. (2024) · Intelligent Cybersecurity Conference (ICSC) · doi:10.1109/icsc63108.2024.10895328 · Cited by 4 · see citing works
LogAn: An LLM-Based Log Analytics Tool with Causal Inferencing
Gupta, P., Bhukar, K., Kumar, H., Nagar, S., Mohapatra, P., & Kar, D. (2025) · ACM/SPEC International Conference on Performance Engineering (ICPE) · doi:10.1145/3680256.3721246 · Cited by 3 · see citing works
Forewarned is Forearmed: A Survey on Large Language Model-based Agents in Autonomous CyberattacksPreprint
Xu, M., Fan, J., Huang, X., Zhou, C., Kang, J., Niyato, D. T., Mao, S., Zhu, H., Xuemin, Shen, S., et al. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2505.12786 · Cited by 3 · see citing works
Citar: Cyberthreat Intelligence-driven Attack Reconstruction
Ghosh, S. K., Gjomemo, R., & Venkatakrishnan, V. N. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3714393.3726519 · Cited by 2 · see citing works
Audit-LLM: Multi-Agent Collaboration for Log-based Insider Threat Detection
Song, C., Ma, L., Zheng, J., Liao, J., Kuang, H., & Yang, L. (2024) · arXiv · doi:10.48550/arxiv.2408.08902 · Cited by 2 · see citing works
Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
de Witt, C. S., Krawiecka, K., Krawczuk, I., Hagag, B., Anderson, W. L., Belcak, P., Bucknall, B., Cai, X., Chopra, A., Cohen, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2505.02077 · Cited by 2 · see citing works
Benchmarking LLMs in an Embodied Environment for Blue Team Threat Hunting
Liu, X., Yu, F., Li, X., Yan, G., Yang, P., & Xi, Z. (2025) · arXiv · doi:10.48550/arxiv.2505.11901
Assess and Summarize: Improve Outage Understanding with Large Language ModelsPreprint
Jin, P., Zhang, S., Ma, M., et al. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2305.18084
Labeling NIDS Rules with MITRE ATT&CK Techniques: Machine Learning vs. Large Language ModelsPreprint
Daniel, N., Kaiser, F. K., Giladi, S., Sharabi, S., Moyal, R., Shpolyansky, S., Murillo, A., Elyashar, A., & Puzis, R. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2412.10978
Revealing the True Indicators: Understanding and Improving IoC Extraction From Threat ReportsPreprint
Froudakis, E., Avgetidis, A., Frankum, S. T., et al. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2506.11325
LLM-Assisted Proactive Threat Intelligence for Automated ReasoningPreprint
Paul, S., Alemi, F., & Macwan, R. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2504.00428
RAS-Eval: A Comprehensive Benchmark for Security Evaluation of LLM Agents in Real-World EnvironmentsPreprint
Fu, Y., Yuan, X., & Wang, D. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2506.15253
Kalakoti, R., Vaarandi, R., Bahsi, H., et al. (2025) · arXiv · doi:10.48550/arxiv.2506.07882
Flagged first, then by citations
Research works printed but not linked: 29
- Mohsin, A.; Janicke, H.; Ibrahim, A.; Sarker, I.H.; Camtepe, S. A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy. arXiv 2025, arXiv:2505.23397v2. [CrossRef] · DOI
- Huang, J.; Jiang, Z.; Chen, Z.; Lyu, M.R. LUNAR: Unsupervised LLM-based Log Parsing. arXiv 2024, arXiv:2406.07174v2. [CrossRef] · DOI
- Akhtar, S.; Khan, S.; Parkinson, S. LLM-based event log analysis techniques: A survey. arXiv 2025, arXiv:2502.00677. [CrossRef] · DOI
- Cheng, Y.; Bajaber, O.; Tsegai, S.A.; Song, D.; Gao, P. CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using LLMs. arXiv 2025, arXiv:2410.21060. · arXiv
- Shah, S.; Parast, F.K. Parast, AI-Driven Cyber Threat Intelligence Automation. arXiv 2024, arXiv:2410.20287v1. [CrossRef] · DOI
- Yang, Y.; Deng, Y.; Xiong, Y.; Li, B.; Xu, H.; Cheng, P. AidAI: Automated Incident Diagnosis for AI Workloads in the Cloud. arXiv 2025, arXiv:2506.01481. [CrossRef] · DOI
- Liu, Z.; Benge, C.; Jiang, S. Ticket-BERT: Labeling incident management tickets with language models. arXiv 2023, arXiv:2307.00108. [CrossRef] · DOI
- Li, C.; Zhu, Z.; He, J.; Zhang, X. RedChronos: A Large Language Model-Based Log Analysis System for Insider Threat Detection in Enterprises. arXiv 2025, arXiv:2503.02702. · arXiv
- Nong, Y.; Yang, H.; Cheng, L.; Hu, H.; Cai, H. APPATCH: Automated Adaptive Prompting Large Language Models for Real-World Software Vulnerability Patching. In Proceedings of the 2025 Network and Distributed System Security Symposium (NDSS 2025), San Diego, CA, USA, 23-26 February 2025; Internet Society: Fredericksburg, VA, USA, 2025; pp. 1-15.
- Wudali, P.N.; Kravchik, M.; Malul, E.; Gandhi, P.A.; Elovici, Y.; Shabtai, A. Rule-ATT&CK Mapper (RAM): Mapping SIEM Rules to TTPs Using LLMs. arXiv 2025, arXiv:2502.02337. · arXiv
- Albanese, M.; Ou, X.; Lybarger, K.; Lende, D.; Goldgof, D. Towards AI-driven human-machine co-teaming for adaptive and agile cyber security operation centers. arXiv 2025, arXiv:2505.06394. · arXiv
- Patel, D.; Lin, S.; Rayfield, J.; Zhou, N.; Vaculin, R.; Martinez, N.; O'donncha, F.; Kalagnanam, J. AssetOpsBench: Benchmarking AI Agents for Task Automation in Industrial Asset Operations and Maintenance. arXiv 2025, arXiv:2506.03828. · arXiv
- Chopra, S.; Ahmad, H.; Goel, D.; Szabo, C. ChatNVD: Advancing Cybersecurity Vulnerability Assessment with Large Language Models. arXiv 2025, arXiv:2412.04756. · arXiv
- Jin, Y.; Li, C.; Fan, P.; Liu, P.; Li, X.; Liu, C.; Qiu, W. LLM-BSCVM: An LLM-based blockchain smart contract vulnerability management framework. arXiv 2025, arXiv:2505.17416. · arXiv
- Torkamani, M.J.; Ng, J.; Mehrotra, N.; Chandramohan, M.; Krishnan, P.; Purandare, R. Streamlining security vulnerability triage with large language models. arXiv 2025, arXiv:2501.18908. [CrossRef] · DOI
- Xiao, Y.; Le, V.H.; Zhang, H. Stronger, Faster, and Cheaper Log Parsing with LLMs. arXiv 2024, arXiv:2406.06156. · arXiv
- Aung, Y.L.; Christian, I.; Dong, Y.; Ye, X.; Chattopadhyay, S.; Zhou, J.; Chattopadhyay, S.; Zhou, J. Generative AI for Internet of Things Security: Challenges and Opportunities. arXiv 2025, arXiv:2502.08886. [CrossRef] · DOI
- Wong, M.Y.; Valakuzhy, K.; Ahamad, M.; Blough, D.; Monrose, F. Understanding LLMs Ability to Aid Malware Analysts in Bypassing Evasion Techniques. In Proceedings of the Companion 26th International Conference on Multimodal Interaction, San Jose, Costa Rica, 4-8 November 2024; ACM: New York, NY, USA, 2024; pp. 36-40. [CrossRef] · DOI
- Xu, M.; Wang, H.; Liu, J.; Lin, Y.; Liu, C.X.Y.; Lim, H.W.; Dong, J.S. IntelEX: A LLM-driven attack-level threat intelligence extraction framework. arXiv 2024, arXiv:2412.10872. · arXiv
- Hays, S.; White, J. Employing LLMs for Incident-Response Planning and Review. arXiv 2024, arXiv:2403.01271. · arXiv
- Sun, Y.; Luo, Y.; Wen, X.; Yuan, Y.; Nie, X.; Zhang, S.; Liu, T.; Luo, X. TrioXpert: An Automated Incident Management Framework for Microservice Systems. arXiv 2025, arXiv:2506.10043. [CrossRef] · DOI
- Kramer, D.; Rosique, L.; Narotam, A.; Bursztein, E.; Kelley, P.G.; Thomas, K.; Woodruff, A. Integrating Large Language Models into Security Incident Response. In Proceedings of the Twenty-First Symposium on Usable Privacy and Security (SOUPS 2025), Seattle, WA, USA, 11-12 August 2025; USENIX Association: Berkeley, CA, USA, 2025; pp. 133-144.
- Singh, R.; Chhetri, M.B.; Nepal, S.; Paris, C. ContextBuddy: AI-Enhanced Contextual Insights for Security Alert Investigation. arXiv 2025, arXiv:2506.09365. · arXiv
- Lian, X.; Chen, Y.; Cheng, R.; Huang, J.; Thakkar, P.; Zhang, M.; Xu, T. Configuration Validation with Large Language Models. arXiv 2023. [CrossRef] · DOI
- Beck, V.; Landauer, M.; Wurzenberger, M.; Skopik, F.; Rauber, A. System Log Parsing with Large Language Models: A Review. arXiv 2025, arXiv:2504.04877. · arXiv
- Shukla, A.; Gandhi, P.A.; Elovici, Y.; Shabtai, A. RuleGenie: SIEM Detection Rule Set Optimization. arXiv 2025. [CrossRef] · DOI
- Bono, J.; Grana, J.; Xu, A. Generative AI and Security Operations Center Productivity: Evidence from Live Operations. arXiv 2024. [CrossRef] · DOI
- Gandhi, P.A.; Shukla, A.; Tayouri, D.; Ifland, B.; Elovici, Y.; Puzis, R.; Shabtai, A. ATAG: AI-Agent Application Threat Assessment with Attack Graphs. arXiv 2025, arXiv:2506.02859. [CrossRef] · DOI
- Page, M.J.; McKenzie, J.E.; Bossuyt, P.M.; Boutron, I.; Hoffmann, T.C.; Mulrow, C.D.; Shamseer, L.; Tetzlaff, J.M.; Akl, E.A.; Brennan, S.E.; et al. The PRISMA 2020 statement: An updated guideline for reporting systematic reviews. BMJ 2021, 372, n71.
Cited by
Sorted by citations
Vinay, V. (2026) · 2026 IEEE 5th International Conference on AI in Cybersecurity (ICAIC) · doi:10.1109/icaic67076.2026.11395809 · Cited by 15 · see citing works
Xin, Q. (2026) · Aviation Electronics Information Technology Telecommunications Electricals Controls (AVITEC) · doi:10.28989/avitec.v8i2.3973 · Cited by 12 · see citing works
AgentSOC: A Multi-Layer Agentic AI Framework for Security Operations Automation
Roy, J., & Singh, S. K. (2026) · IEEE International Conference on AI in Cybersecurity (ICAIC) · doi:10.1109/icaic67076.2026.11395783 · Cited by 7 · see citing works
Alqahtani, H., & Ahuja, P. (2026) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2026.111184 · Cited by 9 · see citing works
Barrios-González, M., Aguiar-Pérez, J. M., Pérez-Juárez, M. A., & Castañeda-de-Benito, E. (2026) · Applied Sciences · doi:10.3390/app16031668 · Cited by 6 · see citing works
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4 · see citing works
“SOAR-LLM [28] dynamically generates and adapts response playbooks rather than following static templates; CyberAlly [27] is reported to have cut MTTR from 8 h to 90 min (vendor case-study figures, not an independent benchmark) in simulated SOC environments.”
InfluentialApplication of Machine Learning Algorithms for Anomaly Detection in Cybersecurity Threat Mitigation
Lim, K. S., Yin, O. S., Chew, Y. J., & Sayeed, M. S. (2026) · Informatica · doi:10.31449/inf.v50i6.10011 · Cited by 4 · see citing works
Bashkirtsev, O., & Doskaliuk, B. (2025) · Anti-Aging Eastern Europe · doi:10.56543/aaeeu.2025.4.4.01 · Cited by 1 · see citing works
Analysis of GitHub Advanced Security: Security Integration in GitHub and Azure DevOps
Manolov, V., Gotseva, D., & Hinov, N. L. (2026) · Future Internet · doi:10.3390/fi18020099 · Cited by 1 · see citing works
Muth, L. R., & Margraf, M. (2026) · IEEE International Systems Conference (SysCon) · doi:10.1109/syscon66367.2026.11503560 · Cited by 1 · see citing works
Kanimozhi, R. (2026) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.70467 · Cited by 1 · see citing works
Risk-Driven Deployment and Forensic Readiness Framework for AI-Enabled Security Operations Centers
Torstensson, O., Prokopovych-Tkachenko, D., Desiatko, A., Hbur, Z. V., & Брітченко, І. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6050149 · Cited by 1 · see citing works
Fatouros, G., Mavrogiorgos, K., Makridis, G., Soldatos, J., & Kyriazis, D. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6050159 · Cited by 1 · see citing works
AutoSOC Cyber Analyst (ASOC-CA): Using AI to Automate SOC Tier 1 & 2 Activities
Mihalopoulos, I., Ngo-Antonio, J.-R., Pugh, M., Neal, D., Cao, Y., & Watkins, L. A. (2026) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc67433.2026.11393893
Liu, Y., Shao, S., Guo, S., Wang, C., Yang, C., & Zang, Z. (2026) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2026.3680460
Suryadi, F. A., & Ramli, K. (2026) · Journal of Vocational Informatics and Computer Education · doi:10.66053/voice.v4i1.449
INQUISITOR: An LLM-Driven Semantic SIEM Model for Automated Threat Intelligence and Log Reasoning
Kumar, P., Rathore, K., Chauhan, K., -, H. V., & Mehra, L. (2026) · IEEE International Conference on Communication Systems and Network Technologies (CSNT) · doi:10.1109/csnt69054.2026.11502206
AI-Based Asynchronous Alert Enrichment Framework for Scalable Security Operations Centers
Karki, D., Ranga, V., & Sisaudia, V. (2026) · International Conference on Smart Futuristic Technology (SMARTTECH) · doi:10.1109/icsft66733.2026.11507831
Artificial intelligence in information security: impact on organisational decision-making
Silva, S. (2026) · Information Research · doi:10.47989/ir31262219
Nandi, S. P., Purushothaman, R., Nethi, S. M., Nutalapati, P., Yadati, N. S. P. K., & -, A. K. T. (2026) · International Conference on Artificial Intelligence, Systems, and Emerging Technologies (ICAISET) · doi:10.1109/icaiset66439.2026.11541715
Data validation: SOC and LLM approaches
Dobrovodsky, P., Kail, E., Fleiner, R., Nyilas, G., Szarvák, A., & Póser, V. (2026) · IEEE International Conference and Workshop Óbuda on Electrical and Power Engineering (CANDO-EPE) · doi:10.1109/cando-epe71091.2026.11569448
Chopra, J. (2026) · Smart innovation, systems and technologies · doi:10.1007/978-3-032-29237-7_38
Дидактичні можливості платформи Minecraft Education Edition у навчанні інформатики
І., Я. О., П., К. М., & С., Я. О. (2026) · doi:10.70286/eoss-29.06.2026
Grynkevych, G., Vasylenko, V., & Rudin, D. (2026) · Cybersecurity Education Science Technique · doi:10.28925/2663-4023.2026.33.1211
Sherry, E., Schreiber, I., & Schreiber, A. (2026) · Information and Computer Security · doi:10.1108/ics-05-2026-0264
Evaluating Multi-Agent Models for Social Engineering Attacks Prevention
Subramani, K. K., & Mohammed, E. A. (2026) · Learning and Technology Conference (L&T) · doi:10.1109/lt68265.2026.11592564
A Quantitative Framework for SOC Maturity Assessment Using MITRE ATT&CK-Based Detection Coverage
Wahed, M. K. Y. A., Aljawarneh, N. M., Almarashdi, F., & Zareer, A. (2026) · International Conference on Technology Enhanced Learning in Higher Education (TELE) · doi:10.1109/tele71748.2026.11591310
AI-Driven Security Operations Centers: A Research Landscape Analysis
Adem, A. İ., Bakal, M. F., & Sezen, A. (2026) · Cognitive Models and Artificial Intelligence Conference (AICCONF) · doi:10.1109/aicconf69182.2026.11600709
LLM-Based Autonomous Agents for Phishing Detection, Triage, and Response
Bazi, I. E., Ezzine, J., & Ghazoui, B. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-2600-0413-5.ch006
GRAL: A GNN-RAG-LLM Framework for Intelligent Cybersecurity Alert Correlation and Analysis
Zhang, D., Wang, J., Gao, H., Feng, Y., Xia, C., Sun, D., & Shen, G. (2026) · Symmetry · doi:10.3390/sym18081334
THAITI Verifiable Synthesis of Wazuh and Suricata Rules for Proactive Threat Hunting
Kotenko, I., & Abramenko, G. (2026) · International Siberian workshops and tutorials on electron devices and materials · doi:10.1109/edm69524.2026.11631947
LLM Fine-Tuned Threat Intelligence Summarization Agent for CVE Report Automation
Giriraju, S. K., Baba, S. K., Mahammad, F. S., & Subramanyam, M. V. (2026) · International Conference on Intelligent and Sustainable AI Systems (ICOSAAS) · doi:10.1109/icosaas68663.2026.11648996
AI Agents, Cybersecurity, and the Future of Digital Trust
Stošić, L. V. (2026) · doi:10.65025/icaic26008s
CyberAgent: An Agentic AI Framework for Autonomous Security Operations with Reduced Operational Cost
Meeampol, S., & Sukma, N. (2026) · Interdisciplinary Journal of Information Knowledge and Management · doi:10.28945/5852
Oliveira, R. S., Gomes, T. F. N., Pinho, D., & Almeida, F. L. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6050147
Kamath, H. G., Kumar, G. K. S., & Samanth, S. (2026) · IEEE Access · doi:10.1109/access.2026.3729667
Yapay Zekâ Destekli SOC Alarm Önceliklendirme Tasarımı Üzerine Bir Araştırma
Nalbaş, B., Nalbant, K. G., & Aydın, S. (2026) · AJIT-e Academic Journal of Information Technology · doi:10.5824/ajite.2026.03.009.x
PACT-IP: A Policy-Governed and Auditable Continuous IP Triage Service for SOCs
Shao, D., Yao, A., Dong, C., Zhang, H., Zhou, H., & Gu, Z. (2026) · IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws72778.2026.00107
Dual-Channel Multi-Level Model for Quantitative Assessment of Data Security in Corporate Networks
Oliinyk, P., Ścisło, Ł., Rusyn, B., Савенко, О., Ciszewski, T., Lysenko, S., Sachenko, A., Savenko, B., & Rucki, R. (2026) · Applied Sciences · doi:10.3390/app16189090
A rule-driven SOC architecture for real-time threat detection and autonomous incident response
Jithendarnadh, J., & Balaraju, J. (2026) · Review of Computer Engineering Research · doi:10.18488/76.v13i3.5150
A Threat Modeling Prioritization and Automation Framework for Composable Architectures
Popescu, L.-M., & Brad, R. (2026) · Future Internet · doi:10.3390/fi18100499
Khot, S. S., & Dhondwad, G. (2026) · International Journal of Innovative Research in Technology · doi:10.64643/ijirt.208799-459
Di, Q., Du, K., Chen, G., & Deng, H. (2026) · Expert Systems · doi:10.1111/exsy.70436
Alhumaidi, A. Y., Al-Qadda, F. A., Alsumayt, A., & Alshammari, M. (2026) · Network · doi:10.3390/network6040084
Usifoh, S., & Umegbewe, N. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7544920
Human-Centered AI and Decision Support in Security Operations Centers
Jain, A., Shukla, A., Chauhan, P. S., & Khan, I. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-2600-1970-2.ch006
Nasr, A. N., Zaitseva-Pärnaste, I., & Kujala, P. (2026) · IEEE Access · doi:10.1109/access.2026.3744593
SyneSA: A synergistic framework for dealing with cybersecurity in a globally distributed enterprise
Perrone, G., & Romano, S. P. (2026) · Future Generation Computer Systems · doi:10.1016/j.future.2026.108875
BAg-IDS: A Blockchain-Enabled Agentic AI Architecture for Trustworthy Intrusion DetectionPreprint
BAHRI, M. A. E., Jemili, F., & MOSBAH, M. (2026) · Research Square · doi:10.21203/rs.3.rs-10843028/v1
HERMES-SOC: An AI Agent as the First Incident Analyst for Small-Scale Security Operations Centers
Yonso, B. A., Yapende-Ko, J.-H., Ndassimba, E., & Ouya, S. (2026) · IEEE International Conference on Information, Communication and Networks (ICICN) · doi:10.1109/icicn71760.2026.11745081
Danquah, P. A., & Henry, M. A. (2026) · Advances in Multidisciplinary & Scientific Research Journal Publication · doi:10.22624/aims/cisdi/v17n3p3
- Authors
- Srinivas, S., Kirk, B., Zendejas, J., Espino, M., Boskovich, M., Bari, A., Dajani, K., & Alzahrani, N.
- Affiliations
- California State University, San Bernardino (US)
- Corresponding author
- Srinivas, Siddhant
- Venue
- Journal of Cybersecurity and Privacy
- Publisher
- MDPI AG
- Published
- 2025-11-05
- Volume
- 5
- Issue
- 4
- Pages
- 95
- ISSN
- 2624-800X (ISSN-L)
- OpenAlex
- W4415932290
- Cited by
- 39
- References
- 58
- Citations by year
- 2026: 38 · 2025: 1
- FWCI
- 16.30
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Journal of Cybersecurity and Privacy (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- California State University, San Bernardino, School of Computer Science and Engineering
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- security operations center, large language models, AI agents, security automation, alert triage, incident response, threat intelligence, vulnerability management, asset discovery, false positives, hallucinations, model interpretability, capability maturity model, explainable AI, cyber threat detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
