Agentic SI in cybersecurity

A detection model answers one question: is this malicious? An agent pursues a goal across several steps. It decides which analysis to run next, gathers evidence, reasons about intent, and proposes or takes an action such as containment. Agency is what turns a prediction into a defence.

1. Observe: ingest a specimen and any existing indicators.
2. Plan: choose the next analysis step (static inspection, sandbox run, similarity search).
3. Reason: update hypotheses about behaviour and intent from the new evidence.
4. Act: propose a mitigation with an expected impact and confidence.
5. Learn: record the outcome so future plans improve.

Autonomous mitigation can cause collateral damage: isolating the wrong host or blocking a shared service. THREATBYTES™ uses graded autonomy. Low-impact steps such as extra analysis run automatically, while containment, isolation, and network changes require approval by a person with the right role. Every proposal, approval, and rejection is written to the audit log.

• Adversarial manipulation: malware designed to steer the agent into harmful or wasteful actions.
• Reward hacking: a learning agent optimising a metric in ways that do not improve security.
• Opacity: actions without an explanation cannot be reviewed or trusted.
• Scope creep: permissions that grow beyond what a task needs.