🤖 AI

Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning

This paper proposes a principled agentic incident response framework that integrates decision-theoretic rollout planning with a digital twin and lightweight LLM agents to generate high-level strategies and executable commands, significantly outperforming frontier LLM baselines by reducing recovery time and increasing recovery rates across diverse attack scenarios.

Original authors: Yiran Gao, Tao Li, Kim Hammar

Published 2026-08-04

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yiran Gao, Tao Li, Kim Hammar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a massive, bustling city where millions of people, businesses, and machines are constantly talking to each other. Sometimes, troublemakers sneak in, trying to steal secrets or shut down power plants. In the real world, when a cyberattack happens, it's usually a team of highly skilled human detectives (called security operators) who have to figure out what's wrong, decide which building to lock down first, and then manually type in commands to fix it. It's like trying to put out a fire in a skyscraper while the building is still on fire, using a manual that might be outdated. This process is slow, exhausting, and often takes months to fully recover, leaving the city vulnerable the whole time.

To speed things up, scientists have tried two main tricks. The first is using "mathematical brains" (algorithms) that can calculate the perfect plan, but these are often too abstract—they know what to do in theory but can't actually type the commands to fix a real server. The second trick is using "super-smart chatbots" (Large Language Models or LLMs) that can read logs and write code. But these chatbots can be unreliable; they sometimes make things up (hallucinate) or get stuck in a loop, trying to fix the wrong thing because they lack a solid game plan. The big question is: Can we build a system that has the strategic brain of a mathematician and the hands-on ability of a chatbot, all while being safe enough to test before it touches the real city?

This paper introduces a clever new system called "Agentic Incident Response" that tries to solve exactly that problem. Think of it as a two-tiered rescue team working together with a "Digital Twin"—a perfect, virtual copy of the city's network where they can practice without risking real damage.

Here's how the team works:

The Strategic Commander (Tactical Scale): First, a mathematical planner looks at the big picture. It doesn't worry about the tiny details of typing commands yet. Instead, it asks, "Which building is most critical to save right now to stop the fire from spreading?" It uses a "rollout" method, which is like playing out thousands of possible futures in a simulation to see which order of saving buildings leads to the fastest recovery.
The Field Agent (Operational Scale): Once the Commander decides, "Save the server in the basement first," a specialized AI agent (a lightweight, fine-tuned chatbot) takes over. Its job is to translate that high-level order into actual, executable commands.
The Safety Net (The Digital Twin): Before the Field Agent sends any commands to the real network, it tests them in the Digital Twin—a virtual replica of the system. If the command works in the simulation, it's approved. If it fails or causes a crash in the virtual world, it's thrown out, and the agent tries a different command. This prevents the AI from accidentally breaking the real system.

The researchers tested this system in a controlled environment with five servers and three different types of cyberattacks (like weak passwords, software bugs, and command injections). They compared their system against the most advanced "frontier" chatbots available today and other existing automated methods.

The results were promising. In their simulations, this new two-part team managed to recover the system 15.1% faster on average than the best standalone chatbots. Even more importantly, they successfully recovered the system 33.6% more often than those same chatbots. While the top-tier chatbots managed to fix the problem about 50% to 75% of the time, this new method kept its success rate above 90%.

The paper suggests that the secret sauce isn't just using a smarter chatbot, but combining the chatbot's ability to write code with a strict, math-based strategy and a safety check in a virtual world. The authors note that the system isn't perfect; if the initial guess about how the attacker is moving is wrong, the plan might be less effective. However, by using a lightweight model that they trained specifically on incident data (rather than a massive, general-purpose model), they showed that you don't need a super-computer to get excellent results. Instead, you need a system that knows when to plan, when to act, and when to double-check its work in a safe, virtual sandbox.

Technical Summary: Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning

Problem Statement

Current incident response (IR) processes are predominantly manual, relying on security operators and predefined playbooks. This approach is often slow, labor-intensive, and requires specialized skills, with reports indicating that organizations can take over 100 days to fully respond to and recover from security incidents. While autonomous cyber defense (ACD) methods based on decision-theoretic approaches (e.g., Reinforcement Learning, Markov Decision Processes) have been proposed to automate planning, they typically operate at an abstract tactical scale. These methods generate high-level strategies (e.g., "defend host X") but fail to produce executable operational commands, limiting their direct applicability to real-world systems.

Conversely, approaches utilizing Large Language Models (LLMs) to generate operational commands suffer from reliability issues. Current agentic LLM approaches often rely on repeated invocations without principled planning algorithms, leading to hallucinations, unreliable plans, and limited planning horizons. Furthermore, many existing LLM-based methods depend on external providers and lack the ability to verify actions before deployment.

There is a critical gap between tactical planning (resource allocation and strategy) and operational execution (generating and verifying specific system commands).

Methodology

The paper proposes a multiscale agentic incident response framework that bridges this gap by integrating decision-theoretic planning with LLM-based command generation, all supported by a Digital Twin (DT). The architecture operates on two distinct scales:

1. Formalization: Factorized POMDP

The authors model incident response as a Factorized Partially Observable Markov Decision Process (POMDP):

State Space ( $s_t$ ): Decomposed into a global security state ( $g_t$ ) representing the compromise status of network components (safe vs. compromised) and local recovery states ( $\ell_t$ ) representing the progress of specific components through six response stages (Containment, Assessment, Preservation, Eviction, Hardening, Restoration).
Actions ( $a_t$ ): Separated into tactical actions (a permutation defining the priority order of components to recover) and operational actions (specific system commands applied to the prioritized component).
Cost Function: Minimizes recovery time while penalizing delays in recovering high-priority or critical components.

2. The Multiscale Architecture

The system employs a Digital Twin that functions in two modes:

Simulation Mode (Tactical Scale): A lightweight abstraction of the network used to simulate attack progression and evaluate high-level recovery strategies.
Emulation Mode (Operational Scale): A virtual replica of the affected system used to execute and verify specific commands before they are applied to the real system.

The planning process involves two stages:

Tactical Planning (Rollout Planner): Using the Digital Twin simulation, a decision-theoretic planner (based on lookahead rollout methods) computes a high-level response strategy. It determines the optimal order of recovering network components to minimize total recovery time and risk propagation.
Operational Planning (LLM Agent): A lightweight, fine-tuned LLM translates the high-level strategy into executable commands.
- Offline Fine-tuning: The authors fine-tune a DeepSeek-R1-14B model on three specific tasks using a dataset of 68,000 incidents: (1) Incident Assessment (inferring attacker tactics), (2) Belief Generation (estimating system state from logs), and (3) Response Action Generation.
- Online Execution: The LLM generates candidate commands, which are then verified via Digital Twin emulation. If a command is verified as effective, it is executed; otherwise, the cost is penalized, and the agent regenerates the plan.

Key Contributions

Factorized POMDP Formulation: The authors formulate incident response as a factorized MDP that explicitly separates network-level tactical planning from server-specific operational planning.
Integrated Agentic Framework: They develop a framework that combines decision-theoretic rollout planning (for strategy) with LLM-based generation (for execution), verified by a Digital Twin. This is the first work to combine tactical planning with operational response generation in this specific manner.
Dual-Mode Digital Twin: Unlike prior works using DTs for either simulation or emulation, this method utilizes both: simulation for efficient tactical planning and emulation for operational verification.
Lightweight Local Implementation: The system uses a locally fine-tuned 14B parameter LLM, reducing dependence on external LLM providers and demonstrating that lightweight models can outperform frontier models when guided by principled planning.

Experimental Results

The method was evaluated on a testbed network with five servers across three attack scenarios: Weak-Credential-3, Shellshock-4, and Command-Injection-5.

Baselines: The system was compared against frontier LLMs (GPT-5.5, Gemini-3.1-Pro, DeepSeek-V4-Pro, Claude-Opus-4.8) and state-of-the-art agentic baselines (IRCopilot, LLM-IR).
Recovery Rate: The proposed agentic approach achieved a recovery rate of ~90% across all scenarios. This significantly outperformed frontier LLMs (which achieved rates between 46.8% and 71.4%) and prior agentic baselines (50.8% to 68.2%).
Execution Time: The approach reduced the average recovery-action execution time by 15.1% compared to frontier LLMs.
Ablation Studies:
- When compared to baselines using the same tactical plan, the proposed method's operational planning (LLM + DT verification) was superior.
- When baselines were forced to perform tactical planning, the proposed method still outperformed them by 53.9% to 57.8% in execution time, highlighting the value of the integrated tactical-operational loop.
LLM Performance: The fine-tuned 14B model achieved high precision and recall (>0.85) for common attack tactics and an 85.3% pass rate in generating effective recovery actions for specific MITRE ATT&CK tactics.

Significance and Claims

The paper claims that the primary significance of this work lies in bridging the gap between abstract decision-theoretic planning and practical operational execution. By combining the strategic rigor of rollout planners with the contextual adaptability of LLMs, and grounding both in a Digital Twin for verification, the system achieves:

Reliability: Mitigating LLM hallucinations through Digital Twin verification.
Efficiency: Reducing recovery time through optimal resource allocation (tactical planning).
Practicality: Operating with a lightweight, locally deployed model that does not rely on external API providers.

The authors conclude that while their method is not perfect—specifically noting limitations regarding attack tactic misspecification (if the LLM infers the wrong tactics, the tactical plan suffers) and the computational cost of LLM rollouts—it represents a principled step toward fully autonomous, reliable, and efficient incident response systems. Future work is identified as addressing the calibration of LLM-based incident assessment to reduce tactic misspecification.