A Secure Agentic AI Framework for Autonomous Cyber Threat Detection, Reasoning, and Response

Abdul Tayab
Department of Software Engineering
Iqra University, Karachi, Pakistan
Independent Research Manuscript
September 2026

Abstract

The rapid expansion of cloud computing, Internet of Things (IoT), edge computing, and distributed digital infrastructures has increased both the scale and complexity of cybersecurity threats. Conventional intrusion detection systems (IDS) primarily focus on identifying anomalous traffic or classifying known attack patterns, while security operations still depend heavily on human analysts for contextual reasoning, investigation, decision-making, and response. Recent advances in large language models (LLMs), tool-augmented reasoning, and autonomous agents provide an opportunity to move beyond passive detection toward intelligent systems capable of interpreting security evidence, planning investigative actions, and recommending or executing controlled defensive responses. However, giving an AI system access to cybersecurity tools introduces new risks, including hallucination, prompt injection, excessive agency, unsafe tool execution, privilege escalation, and incorrect automated responses.

This paper proposes Secure Agentic AI Framework (SAAF), a security-oriented agentic architecture for autonomous cyber threat detection, reasoning, investigation, and response. The framework integrates machine-learning-based anomaly detection with LLM-based reasoning, retrieval-augmented threat intelligence, MITRE ATT&CK knowledge, specialized security tools, memory, policy enforcement, confidence estimation, and human-in-the-loop controls. Instead of allowing a single LLM to directly execute defensive actions, SAAF separates detection, investigation, reasoning, validation, decision, and response into controlled agentic stages. The proposed architecture contains six major components: Threat Detection Agent, Threat Intelligence Agent, Investigation Agent, Reasoning and Planning Agent, Response Validation Agent, and Security Response Agent. A policy and authorization layer governs all tool calls and prevents high-risk actions from being executed without appropriate validation.

The framework is designed to evaluate detection accuracy, attack classification, reasoning quality, evidence grounding, response correctness, false-positive reduction, response latency, tool-use safety, and resistance to adversarial inputs. Public cybersecurity datasets including CICIDS2017, CSE-CIC-IDS2018, UNSW-NB15, BoT-IoT, TON_IoT, and Edge-IIoTset can provide heterogeneous network and IoT security evidence for evaluation. The proposed approach therefore combines conventional machine learning and deep learning detection capabilities with agentic reasoning rather than replacing established security models entirely.

The central contribution is a controlled autonomous cyber-defense loop in which an agent observes security events, correlates evidence, reasons over possible attack hypotheses, retrieves relevant threat intelligence, proposes a response, validates that response against security policies, and performs only authorized actions. The design emphasizes explainability, least privilege, zero-trust principles, and auditable decision traces. The framework provides a foundation for developing safer autonomous security operations while explicitly recognizing that autonomous cyber defense must be evaluated not only for detection performance but also for reasoning reliability and action safety.

Keywords: Agentic AI, Cybersecurity, Large Language Models, Autonomous Cyber Defense, Threat Detection, Threat Intelligence, Machine Learning, Deep Learning, LLM Agents, Security Operations Center, MITRE ATT&CK, Zero Trust, Explainable AI, Tool-Augmented AI, IoT Security.

1. Introduction

Modern cyber infrastructures are no longer restricted to traditional enterprise networks. Organizations increasingly operate across cloud platforms, edge environments, IoT devices, mobile systems, APIs, remote endpoints, and distributed services. This heterogeneity creates a large volume of security telemetry that must be continuously monitored and interpreted.

Traditional IDS and Security Information and Event Management (SIEM) systems can detect suspicious patterns, correlate events, and generate alerts, but the final investigation frequently requires a security analyst. A typical analyst may need to inspect network flows, authentication logs, endpoint telemetry, threat-intelligence reports, historical incidents, and attack frameworks before determining whether an alert represents a real threat.

Machine learning has improved automated anomaly detection and classification. However, conventional classifiers generally produce a prediction rather than a complete investigation. For example, an IDS may classify an event as a denial-of-service attack but does not necessarily explain:

1. Why the event is suspicious;

2. Which additional evidence should be collected;

3. Which MITRE ATT&CK technique may be involved;

4. Whether multiple alerts belong to the same attack campaign;

5. What defensive action should be taken;

6. Whether that action is safe to execute automatically.
   
   

   
   
   
   

Large language models introduce a different capability: contextual reasoning over heterogeneous textual and structured information. Research on reasoning-and-action systems such as ReAct demonstrates how language models can interleave reasoning with external actions, while Toolformer demonstrates how language models can learn to use external tools. Multi-agent frameworks such as AutoGen further demonstrate how multiple specialized agents can collaborate through structured interactions.

However, autonomous action introduces a new security boundary.

An LLM that only generates a textual explanation may produce an incorrect answer. An LLM connected to a firewall, endpoint management system, cloud API, identity platform, or incident-response tool may potentially produce an incorrect action. OWASP identifies excessive agency as a major risk when LLM-based systems are given permissions to invoke functions or interact with external systems.

Therefore, the central question of this research is:

How can agentic AI be designed to reason over cyber threats and coordinate defensive actions while preventing unsafe autonomous behavior?

This paper proposes SAAF as a controlled architecture that treats autonomous cyber defense as a combination of:

rather than simply:

2. Research Motivation

Existing cybersecurity automation approaches can be broadly divided into four categories.

2.1 Rule-Based Security Automation

Rule-based systems use predefined signatures, thresholds, correlation rules, and policies. They are predictable and auditable but can struggle with previously unseen attack patterns.

2.2 Machine-Learning-Based Detection

ML and DL models can learn statistical representations of network traffic and system behavior. Public datasets such as UNSW-NB15, CICIDS2017, BoT-IoT, TON_IoT, and Edge-IIoTset support research into network, IoT, and IIoT intrusion detection.

Their primary limitation is that classification does not automatically provide an end-to-end investigation.

2.3 LLM-Assisted Cybersecurity

LLMs can summarize logs, explain vulnerabilities, generate detection rules, and assist security analysts. A 2024 survey of LLMs for cyber-threat detection identifies multiple potential roles for LLMs across threat-detection workflows.

2.4 Agentic Cybersecurity

Agentic AI extends LLM assistance by allowing systems to plan tasks, invoke tools, retrieve information, maintain memory, and perform actions. ReAct, Toolformer, AutoGen, Reflexion, and related work establish important foundations for reasoning, tool use, multi-agent interaction, and iterative feedback.

The research gap therefore lies not simply in using an LLM for cybersecurity, but in designing a secure control architecture around autonomous reasoning and action.

3. Research Objectives

The proposed research has six primary objectives:

Objective 1 — Intelligent Threat Detection

Develop an ML/DL-based detection layer capable of identifying anomalous and malicious activity from heterogeneous cybersecurity datasets.

Objective 2 — Contextual Threat Reasoning

Use an LLM-based reasoning component to combine alerts with logs, threat intelligence, historical incidents, and attack knowledge.

Objective 3 — Autonomous Investigation

Enable specialized agents to determine what additional evidence should be collected before a response decision is made.

Objective 4 — Controlled Response Planning

Generate defensive response plans while separating response generation from response authorization.

Objective 5 — Secure Agent Execution

Prevent unsafe actions using policy enforcement, least privilege, tool restrictions, validation, confidence thresholds, and human approval for high-impact operations.

Objective 6 — Explainable Cyber Defense

Produce an auditable reasoning record showing the evidence, detected threat, supporting intelligence, proposed action, validation result, and final response.

4. Research Questions

The research investigates the following questions:

RQ1: Can an agentic architecture improve contextual cyber-threat investigation compared with standalone ML-based detection?

RQ2: Can multiple specialized agents improve threat analysis by separating detection, investigation, intelligence retrieval, reasoning, and response responsibilities?

RQ3: How effectively can retrieval-augmented threat intelligence improve the evidence-grounding of security decisions?

RQ4: Can policy-based response validation reduce unsafe autonomous actions?

RQ5: How does the proposed framework perform across heterogeneous network, IoT, and IIoT datasets?

RQ6: What trade-offs exist between detection accuracy, reasoning quality, response latency, and autonomous action safety?

5. Background and Related Work

5.1 Large Language Models

Modern LLMs have demonstrated capabilities in language understanding, generation, reasoning, coding, and interaction with external environments. Chain-of-thought prompting showed that intermediate reasoning can improve complex reasoning tasks, while later work demonstrated more structured approaches to deliberate reasoning.

However, cybersecurity introduces stricter requirements because incorrect reasoning can potentially produce incorrect security decisions.

5.2 Reasoning and Acting

ReAct combines reasoning traces with task-specific actions, allowing models to interact with external sources while reasoning about the task.

For cybersecurity, this concept can be adapted so that an agent:

Observe → Reason → Query → Observe → Reassess → Act

For example:

5.3 Tool-Augmented LLMs

Toolformer demonstrated the ability of language models to interact with external APIs and determine when tools should be used.

In a cybersecurity environment, tools may include:

• SIEM query engines

• Network-flow analyzers

• Malware-analysis systems

• Threat-intelligence databases

• Vulnerability scanners

• Endpoint telemetry systems

• Firewall APIs

• Identity-management systems

• Cloud security APIs

The key difference in SAAF is that tool availability does not equal unrestricted tool authority.

5.4 Multi-Agent AI

AutoGen demonstrates a framework in which multiple agents can collaborate through conversations and tool interactions.

SAAF adopts the multi-agent concept but assigns cybersecurity-specific responsibilities to each agent.

Instead of one general-purpose agent:

6. Proposed Secure Agentic AI Framework

6.1 Architecture Overview

The proposed framework consists of eight logical layers.

Layer 1 — Cybersecurity Data Sources

The framework receives:

• Network flows

• Packet metadata

• Authentication logs

• Endpoint events

• DNS events

• Cloud telemetry

• IoT sensor data

• System logs

• Threat-intelligence feeds

Layer 2 — Detection Engine

Machine-learning models process the incoming data.

Candidate algorithms include:

• Random Forest

• XGBoost

• Support Vector Machine

• CNN

• LSTM

• Autoencoder

• Transformer-based classifier

The detection layer produces:

Event ID
Attack Class
Probability
Feature Importance
Timestamp
Source
Destination
Severity

6.2 Threat Detection Agent

The Threat Detection Agent receives outputs from ML/DL models and determines whether an event requires further investigation.

Example:

Prediction:
DDoS

Confidence:
0.94

Severity:
High

Investigation:
Required

The agent does not immediately block the source.

7. Investigation Agent

The Investigation Agent performs contextual evidence collection.

For example:

Alert:
Multiple failed authentication attempts

Investigation Plan:
1. Inspect authentication logs
2. Identify source IP
3. Check previous activity
4. Search threat intelligence
5. Identify affected accounts
6. Correlate timestamps

This design is influenced by agent architectures where models use tools and iterative feedback rather than generating a single response.

8. Threat Intelligence Agent

The Threat Intelligence Agent connects observed evidence to external knowledge.

Potential knowledge sources include:

• MITRE ATT&CK

• CVE databases

• STIX/TAXII feeds

• Malware intelligence

• IP reputation

• Domain reputation

• Internal incident history

MITRE ATT&CK provides tactics representing adversarial goals and techniques describing how those goals are achieved.

For example:

9. Reasoning and Planning Agent

The Reasoning Agent receives structured evidence rather than relying exclusively on raw prompts.

A simplified reasoning representation is:

$$H = f(E,T,K,C)$$

where:

• $H$ = threat hypothesis

• $E$ = observed evidence

• $T$ = threat intelligence

• $K$ = cybersecurity knowledge

• $C$ = contextual information

The agent generates competing hypotheses rather than immediately accepting the first explanation.

Example:

Hypothesis H1:
Credential attack

Evidence:
Repeated authentication failures
Unusual geographic source
Known malicious IP

Confidence:
High

Hypothesis H2:
Legitimate user error

Evidence:
Repeated login attempts

Confidence:
Low

The agent then identifies which evidence supports or contradicts each hypothesis.

10. Retrieval-Augmented Security Reasoning

A major component of SAAF is retrieval-augmented reasoning.

Instead of asking:

"What attack is this?"

the system performs:

This reduces dependence on the model's internal knowledge and provides evidence that can be inspected.

However, long-context LLMs can still have difficulty consistently using information positioned within large contexts, motivating careful retrieval and context management.

11. Response Planning Agent

Once a threat hypothesis reaches the required confidence level, the Response Agent generates possible actions.

Example:

Threat:
Malicious SSH brute-force activity

Candidate Actions:

A1 — Block source IP
A2 — Rate-limit authentication
A3 — Disable affected account temporarily
A4 — Increase monitoring
A5 — Request human approval

The system does not automatically select the most destructive action.

Instead, each response receives a risk score:

$$R_a = P_a \times I_a \times S_a$$

where:

• $P_a$ = estimated probability of incorrect action

• $I_a$ = potential impact

• $S_a$ = system sensitivity

Higher-risk actions require stronger validation.

12. Response Validation Layer

This is the primary security barrier of SAAF.

The Response Validator checks:

Identity

Who is requesting the action?

Authorization

Is the agent authorized to perform it?

Scope

Which system will be affected?

Confidence

How strong is the supporting evidence?

Reversibility

Can the action be undone?

Blast Radius

How many systems/users may be affected?

Policy

Does the action violate organizational security policy?

13. Zero-Trust Agent Execution

SAAF applies zero-trust principles to agent actions.

NIST defines zero trust around protecting resources rather than assuming trust based on network location, with authentication and authorization performed before access.

The same principle is applied to agents:

Never trust an agent merely because it is an internal component.

Each tool request is evaluated independently.

14. Human-in-the-Loop Control

Not every cybersecurity action should be autonomous.

The framework therefore defines three response classes.

Risk Level	Example	Approval
Low	Increase monitoring	Automatic
Medium	Temporary rate limiting	Policy-dependent
High	Disable production account	Human approval
Critical	Shutdown production infrastructure	Mandatory human approval

This design creates a controlled boundary between AI recommendation and AI execution.

15. Security Against Agentic AI Attacks

An autonomous security agent itself becomes a potential attack surface.

OWASP's 2025 GenAI guidance identifies excessive agency as a risk when LLM systems can invoke tools and perform actions, including situations involving manipulated or unexpected model outputs.

SAAF therefore considers:

15.1 Prompt Injection

Malicious text attempts to manipulate the agent's instructions.

15.2 Indirect Prompt Injection

Malicious instructions are hidden inside retrieved content, logs, documents, or external data.

15.3 Tool Manipulation

An attacker attempts to cause unsafe tool invocation.

15.4 Privilege Escalation

An agent attempts to perform an action beyond its assigned permissions.

15.5 Data Poisoning

Malicious or corrupted telemetry influences model decisions.

15.6 Hallucinated Evidence

The LLM generates unsupported facts.

15.7 Agent-to-Agent Manipulation

One compromised agent attempts to influence another agent.

15.8 Excessive Autonomy

The agent performs actions beyond what is necessary to resolve an incident.

16. Proposed Defense Mechanisms

SAAF uses multiple controls.

Control 1 — Tool Allowlisting

Only explicitly registered tools can be invoked.

Control 2 — Parameter Validation

Arguments passed to tools are validated before execution.

Control 3 — Least Privilege

Agents receive only the permissions required for their role.

Control 4 — Evidence Grounding

Important decisions must reference retrieved evidence.

Control 5 — Confidence Thresholds

Low-confidence decisions cannot directly trigger high-impact actions.

Control 6 — Action Simulation

High-impact responses can first be evaluated in a sandbox.

Control 7 — Human Approval

Critical actions require analyst confirmation.

Control 8 — Complete Audit Trail

Every observation, tool call, decision, and response is logged.

17. Self-Reflection and Feedback

Agentic systems can use feedback to improve subsequent decisions. Reflexion, for example, uses verbal feedback and episodic memory rather than updating model weights after every interaction.

SAAF adapts this idea for incident response.

After an incident:

The memory should contain validated security knowledge rather than unrestricted model-generated memories.

18. Explainability

Every final decision should produce an explanation object.

Example:

{
  "incident": "INC-2026-0042",
  "threat": "Credential Attack",
  "confidence": 0.91,
  "evidence": [
    "Multiple failed logins",
    "Unusual source IP",
    "Threat-intelligence match"
  ],
  "attack_mapping": "MITRE ATT&CK Credential Access",
  "proposed_action": "Temporarily block source",
  "risk_level": "Medium",
  "authorization": "Policy Approved"
}

The objective is not to expose private internal chain-of-thought. Instead, the framework produces a structured decision rationale containing evidence, factors, confidence, policy checks, and action justification.

19. Experimental Methodology

19.1 Datasets

The evaluation can use multiple datasets to test generalization.

CICIDS2017

A widely used intrusion-detection dataset containing benign and malicious network traffic.

CSE-CIC-IDS2018

A subsequent intrusion-detection benchmark providing additional attack scenarios.

UNSW-NB15

UNSW-NB15 contains normal and synthetic contemporary attack behavior and includes nine attack categories with 49 generated features.

BoT-IoT

The BoT-IoT dataset was developed using a realistic IoT network environment and contains attack categories including DDoS, DoS, scanning, keylogging, and data exfiltration.

TON_IoT

TON_IoT combines heterogeneous IoT/IIoT telemetry, operating-system data, and network traffic and was designed for evaluating AI-based cybersecurity applications.

Edge-IIoTset

Edge-IIoTset provides a realistic cybersecurity dataset for IoT/IIoT environments and supports centralized and federated-learning research.

20. Data Processing Pipeline

The data pipeline should avoid leakage between training and test environments.

21. Detection Models

The experimental baseline can include:

1. Logistic Regression

2. Random Forest

3. XGBoost

4. SVM

5. CNN

6. LSTM

7. Autoencoder

8. Transformer-based detector

The best-performing detector is then integrated with the agentic layer.

22. Agent Configuration

A prototype implementation can use:

Python
FastAPI
Scikit-learn
PyTorch
LangChain / equivalent orchestration layer
Vector Database
PostgreSQL
Redis
Docker
REST APIs
MITRE ATT&CK knowledge
Threat-intelligence feeds

The exact LLM should be treated as a replaceable component so that the framework is not tied to a single model provider.

23. Evaluation Metrics

23.1 Detection Metrics

Accuracy:

$$Accuracy=\frac{TP+TN}{TP+TN+FP+FN}$$

Precision:

$$Precision=\frac{TP}{TP+FP}$$

Recall:

$$Recall=\frac{TP}{TP+FN}$$

F1-score:

$$F1=2\frac{Precision\times Recall}{Precision+Recall}$$

23.2 Agent Metrics

The framework introduces additional metrics.

Evidence Grounding Rate

$$EGR=\frac{\text{Evidence-supported claims}}{\text{Total security claims}}$$

Safe Action Rate

$$SAR=\frac{\text{Correctly authorized actions}}{\text{Total attempted actions}}$$

Response Accuracy

$$RA=\frac{\text{Correct responses}}{\text{Total incidents}}$$

False Autonomous Action Rate

$$FAAR=\frac{\text{Unsafe autonomous actions}}{\text{Total autonomous actions}}$$

Mean Response Time

$$MRT=\frac{\sum_{i=1}^{n} ResponseTime_i}{n}$$

24. Experimental Scenarios

The evaluation should include at least five scenarios.

Scenario A — Known Attack

The system receives an attack represented in the training data.

Scenario B — Unseen Attack Pattern

The system receives a previously unseen attack class or distribution shift.

Scenario C — Multi-Stage Attack

Several apparently independent alerts belong to one attack campaign.

Scenario D — Malicious Retrieved Content

Threat-intelligence content contains adversarial instructions.

Scenario E — High-Risk Response

The agent proposes a potentially destructive action and must pass policy validation.

25. Ablation Study

The framework should be evaluated component-by-component.

Configuration	Detection	Reasoning	Threat Intel	Validation
ML only	✓	—	—	—
ML + LLM	✓	✓	—	—
ML + LLM + RAG	✓	✓	✓	—
Full SAAF	✓	✓	✓	✓

This experiment determines whether each architectural component contributes measurable value.

26. Results and Evaluation Findings

Important methodological note

Because this manuscript is being prepared as an independent research manuscript rather than reporting a completed benchmark run, numerical performance values are intentionally not fabricated. The result section therefore reports the framework-level findings that the proposed architecture is designed to establish, together with the exact metrics required for the final empirical version.

This distinction is important for academic credibility.

26.1 Expected Detection Finding

The ML detection layer is expected to provide quantitative detection performance through precision, recall, F1-score, ROC-AUC, and false-positive rate.

The agentic layer does not replace this detector. Instead, it consumes detector outputs and adds contextual investigation and response reasoning.

26.2 Expected Reasoning Finding

The main expected benefit of SAAF is the transformation of an isolated alert into a structured investigation.

For example:

Traditional IDS:

Alert → DDoS

SAAF:

Alert
 ↓
Traffic Analysis
 ↓
Historical Correlation
 ↓
Threat Intelligence
 ↓
ATT&CK Mapping
 ↓
Attack Hypothesis
 ↓
Risk Assessment
 ↓
Validated Response

This represents a qualitative expansion of the security workflow rather than simply a change in classification accuracy.

26.3 Expected Safety Finding

The Response Validation Layer is expected to reduce unsafe autonomous actions by separating:

"The agent recommends an action"

from

"The system permits the action."

This separation is particularly important because excessive agency can allow unexpected or manipulated model outputs to produce damaging actions.

26.4 Expected Explainability Finding

Each incident produces a structured record containing:

• Evidence

• Threat hypothesis

• Confidence

• Threat-intelligence references

• ATT&CK mapping

• Proposed action

• Risk level

• Authorization status

• Final outcome

This makes the system more auditable than a black-box autonomous response pipeline.

27. Proposed Result Table for Final Experimental Version

The following table should be populated after running the experiments:

Metric	ML Baseline	ML + LLM	ML + RAG	Full SAAF
Accuracy	TBD	TBD	TBD	TBD
Precision	TBD	TBD	TBD	TBD
Recall	TBD	TBD	TBD	TBD
F1-score	TBD	TBD	TBD	TBD
False Positive Rate	TBD	TBD	TBD	TBD
Evidence Grounding	TBD	TBD	TBD	TBD
Response Accuracy	TBD	TBD	TBD	TBD
Mean Response Time	TBD	TBD	TBD	TBD
Unsafe Action Rate	TBD	TBD	TBD	TBD

TBD values should be replaced with measured results before presenting the manuscript as an experimentally validated research paper.

28. Discussion

The proposed architecture suggests that autonomous cyber defense should not be treated as a single-model problem.

A high-performing classifier alone does not solve incident response. Similarly, an LLM with strong language capabilities does not automatically become a reliable security analyst.

The proposed architecture instead combines:

$$CyberDefense = Detection + Intelligence + Reasoning + Validation + Response$$

The framework also recognizes that increasing agent autonomy increases the importance of security controls.

The relationship can be expressed conceptually as:

$$Risk_{agent} \propto Autonomy \times Privilege \times Uncertainty$$

Therefore, increasing autonomy should be accompanied by stronger authorization and validation mechanisms.

29. Security and Governance Considerations

NIST CSF 2.0 provides a broad cybersecurity risk-management structure applicable across organizations and emphasizes governance alongside cybersecurity outcomes.

NIST's Generative AI Profile further highlights the need to manage risks throughout the AI lifecycle.

For agentic cybersecurity, governance should therefore cover:

• Model selection

• Tool permissions

• Data provenance

• Prompt security

• Logging

• Human oversight

• Incident auditing

• Model updates

• Evaluation

• Access control

• Data privacy

• Fail-safe behavior

30. Limitations

Several limitations remain.

First, public cybersecurity datasets may not fully represent modern production environments.

Second, benchmark performance may not translate directly to operational SOC environments.

Third, LLM behavior can vary between models, versions, prompts, and tool configurations.

Fourth, retrieval systems can return incomplete or misleading evidence.

Fifth, autonomous response remains sensitive to authorization errors and environmental assumptions.

Sixth, adversarial attackers may intentionally target the agent's reasoning process.

Therefore, the framework should be treated as a controlled research architecture rather than a claim of fully autonomous and universally reliable cyber defense.

31. Future Work

Future development will investigate:

1. Federated learning for distributed security telemetry;

2. Continual learning against evolving attack patterns;

3. Digital twins for safe response simulation;

4. Graph-based attack-path reasoning;

5. Adversarial testing of security agents;

6. Multi-agent consensus mechanisms;

7. Privacy-preserving threat intelligence;

8. Blockchain-based audit trails;

9. Edge-based agent deployment;

10. Cyber-physical system protection;

11. Automated MITRE ATT&CK technique discovery;

12. Agent memory security;

13. Formal policy verification;

14. Zero-trust agent identity;

15. Human-agent collaborative SOC environments.

32. Conclusion

This paper presented SAAF — a Secure Agentic AI Framework for Autonomous Cyber Threat Detection, Reasoning, and Response.

The proposed architecture combines machine-learning-based detection with LLM reasoning, threat-intelligence retrieval, multi-agent investigation, structured evidence analysis, MITRE ATT&CK mapping, policy-based authorization, and controlled response execution.

Unlike a simple LLM-based security assistant, SAAF explicitly separates:

Detection → Investigation → Reasoning → Planning → Validation → Response.

This separation is central to the framework's security model.

The research argues that the future of AI-assisted cybersecurity should not be defined solely by how accurately an AI model identifies an attack. It should also be evaluated by whether the system can explain its decision, use reliable evidence, respect authorization boundaries, resist malicious inputs, and safely interact with security infrastructure.

The resulting architecture provides a research foundation for developing autonomous security systems that combine the analytical capabilities of machine learning with the contextual reasoning and tool-use capabilities of modern AI agents, while maintaining explicit controls over autonomous action.

References

[1] S. Yao, D. Yu, J. Zhao, I. Shafran, T. L. Griffiths, Y. Cao, and K. Narasimhan, “Tree of Thoughts: Deliberate Problem Solving with Large Language Models,” 2023.

[2] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, “ReAct: Synergizing Reasoning and Acting in Language Models,” 2022.

[3] T. Schick et al., “Toolformer: Language Models Can Teach Themselves to Use Tools,” NeurIPS, 2023.

[4] Q. Wu et al., “AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation,” 2023.

[5] N. Shinn et al., “Reflexion: Language Agents with Verbal Reinforcement Learning,” NeurIPS, 2023.

[6] A. Madaan et al., “Self-Refine: Iterative Refinement with Self-Feedback,” 2023.

[7] J. Wei et al., “Chain-of-Thought Prompting Elicits Reasoning in Large Language Models,” 2022.

[8] Y. Bai et al., “Constitutional AI: Harmlessness from AI Feedback,” 2022.

[9] N. F. Liu et al., “Lost in the Middle: How Language Models Use Long Contexts,” TACL, 2024.

[10] J. Yang et al., “SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering,” NeurIPS, 2024.

[11] G. Wang et al., “Voyager: An Open-Ended Embodied Agent with Large Language Models,” 2023.

[12] Y. Liu et al., “G-Eval: NLG Evaluation using GPT-4 with Better Human Alignment,” 2023.

[13] P. Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” NeurIPS, 2020.

[14] P. Mialon et al., “Augmented Language Models: A Survey,” 2023.

[15] T. Brown et al., “Language Models are Few-Shot Learners,” NeurIPS, 2020.

[16] A. Vaswani et al., “Attention Is All You Need,” NeurIPS, 2017.

[17] J. Devlin et al., “BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding,” NAACL, 2019.

[18] OpenAI et al., “GPT-4 Technical Report,” 2023.

[19] P. Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” 2020.

[20] P. Manakul, A. Liusie, and M. Gales, “SelfCheckGPT: Zero-Resource Black-Box Hallucination Detection for Generative Large Language Models,” 2023.

[21] N. Shinn et al., “Reflexion: Language Agents with Verbal Reinforcement Learning,” 2023.

[22] M. Schick et al., “Toolformer,” 2023.

[23] OWASP Foundation, “LLM06:2025 Excessive Agency,” OWASP GenAI Security Project, 2025.

[24] National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile,” NIST AI 600-1, 2024.

[25] C. Pascoe, S. Quinn, and K. Scarfone, “The NIST Cybersecurity Framework (CSF) 2.0,” NIST CSWP 29, 2024.

[26] K. Rigopoulos et al., “NIST Cybersecurity Framework 2.0: Resource & Overview Guide,” NIST SP 1299, 2024.

[27] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero Trust Architecture,” NIST SP 800-207, 2020.

[28] R. Chandramouli and Z. Butcher, “A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments,” NIST SP 800-207A, 2023.

[29] MITRE, “ATT&CK Enterprise Tactics,” MITRE ATT&CK Knowledge Base.

[30] MITRE, “ATT&CK Enterprise Techniques,” MITRE ATT&CK Knowledge Base.

[31] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization,” ICISSP, 2018.

[32] N. Moustafa and J. Slay, “UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems,” MilCIS, 2015. The dataset was generated using the UNSW Canberra Cyber Range and contains both normal and contemporary attack behavior.

[33] N. Moustafa et al., “TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems,” IEEE Access, 2020.

[34] N. Koroniotis et al., “Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset,” Future Generation Computer Systems, 2019.

[35] M. A. Ferrag et al., “Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning,” IEEE Access, 2022.

[36] A. H. Lashkari et al., “Characterization of Tor Traffic using Time Based Features,” 2017.

[37] N. Shone et al., “A Deep Learning Approach to Network Intrusion Detection,” IEEE Transactions on Emerging Topics in Computational Intelligence, 2018.

[38] W. Wang et al., “HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection,” IEEE Access, 2018.

[39] R. Vinayakumar et al., “Deep Learning Approach for Intelligent Intrusion Detection System,” IEEE Access, 2019.

[40] Y. Xin et al., “Machine Learning and Deep Learning Methods for Cybersecurity,” IEEE Access, 2018.

[41] M. Ring et al., “A Survey of Network-Based Intrusion Detection Data Sets,” Computers & Security, 2019.

[42] S. Garcia et al., “An Empirical Comparison of Botnet Detection Methods,” Computers & Security, 2014.

[43] K. Scarfone and P. Mell, “Guide to Intrusion Detection and Prevention Systems,” NIST SP 800-94, 2007.

[44] N. F. Liu et al., “Lost in the Middle: How Language Models Use Long Contexts,” 2023/2024.

[45] Y. Liu et al., “A Survey of Large Language Models for Cyber Threat Detection,” Computers & Security, 2024.

[46] “Secure Autonomous Cyber Defense with LLM Agents: A Systematic Review of Autonomy, Tool-Augmented Reasoning, and Governance Constraints,” Computers & Electrical Engineering, 2026.

[47] Q. Wu et al., “AutoGen: Enabling Next-Generation Large Language Model Applications,” Microsoft Research, 2023.

[48] J. Yang et al., “SWE-Agent: Agent-Computer Interfaces Enable Automated Software Engineering,” NeurIPS, 2024.

[49] A. Madaan et al., “Self-Refine: Iterative Refinement with Self-Feedback,” 2023.

[50] T. Schick et al., “Toolformer: Language Models Can Teach Themselves to Use Tools,” NeurIPS, 2023.