Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning
2026-08-03 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors explain that managing security incidents is usually slow because humans follow fixed rules. They propose a new way to automate this process by combining smart planning methods with large language models (LLMs), which can understand security knowledge. Their system first plans big-picture strategies using simulations, then an LLM executes detailed commands. Tests showed their method speeds up recovery and improves success compared to previous LLM-based methods.
incident responselarge language modelsdecision-theoretic planningrollout plannerdigital twinsecurity automationsimulationemulationreinforcement learning
Authors
Yiran Gao, Tao Li, Kim Hammar
Abstract
Incident response is currently managed by security operators using predefined playbooks, resulting in slow, labor-intensive security decision-making processes. Consequently, there is a growing need for automated incident response planning. Decision-theoretic approaches based on control, optimization, and reinforcement learning have been proposed to automate such planning tasks with well-grounded approaches, yet most of which, while guaranteeing strong performance, are limited to abstract models and cannot be directly applied to operational systems. A promising approach to mitigate this limitation is to use the security knowledge embedded in large language models (LLMs) to develop agentic response systems. However, current agentic approaches rely on repeated invocations of the LLM to generate a response plan, which is unreliable and limits the planning horizon due to hallucination. In this paper, we develop a principled LLM-based planning method by combining decision-theoretic planning with LLM-generated response commands. The proposed agentic incident response approach uses a rollout planner to compute a high-level response strategy that allocates security resources (the tactical scale), which is then translated into executable commands by a lightweight LLM agent (the operational scale). Within this architecture, we use a digital twin that supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios, our agentic approach reduces recovery execution time by 15.1\% on average and increases the recovery rate by 33.6\% over frontier LLM baselines.