SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response

2026-07-29

AI Summary

This study addresses the critical gap in existing cybersecurity benchmarks, which predominantly focus on idealized pre-attack scenarios and lack systematic evaluation of AI agents’ capabilities in post-compromise response. To bridge this void, the authors introduce SecRespond—the first benchmark specifically designed for post-attack response assessment—comprising ten realistic evaluation tasks derived from disk snapshots, alerts, vulnerability scans, and baseline configurations of compromised cloud hosts, spanning multiple initial access vectors, MITRE ATT&CK tactics, and operating systems. Leveraging the OpenCode agent framework that integrates digital forensics, vulnerability analysis, and large language model reasoning, the evaluation of 23 state-of-the-art models reveals that while current agents can handle known alerts, they exhibit significant deficiencies in proactively identifying stealthy intrusions and generating verifiable, comprehensive remediation plans. Notably, no model achieves full detection and repair in any scenario, underscoring the urgent need for more robust post-compromise AI-driven security response mechanisms.

Abstract

Large Language Model (LLM) agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces (CLIs), making it critical to thoroughly assess their security capabilities. However, existing cybersecurity benchmarks focus on pre-compromise settings where agents are placed in a clean and idealized environment before an attack occurs. This leaves the post-compromise setting underexplored. To address this gap, we introduce SecRespond, the first benchmark for evaluating LLM agents on the post-compromise incident-response workflow. Given a forensic disk snapshot of a compromised host together with the alerts, vulnerability scans, and baseline checks reported by a host security product, agents are required to produce forensic reports on intrusions, baseline risks, and vulnerability risks, together with a remediation plan. We instantiate this task across 10 cyber ranges, each constructed from a distinct compromised cloud host, spanning 4 entry-point types, 21 ATT&CK techniques, and 5 operating systems. We evaluate 23 frontier LLMs on the OpenCode agent harness. Experimental results show that although current agents can reliably uncover the problems exposed by alerts, they struggle to proactively investigate the disk for silent intrusions and to produce comprehensive, verified remediation plans, with no model achieving complete detection and remediation on any single range. This reveals a fundamental bottleneck in building agents for real-world incident response. The benchmark is publicly available at https://github.com/Alibaba-NLP/qqr/tree/main/data/secrespond.

Problem

• post-compromise
• incident response
• LLM agents
• cybersecurity benchmark
• forensic analysis

Innovation

• post-compromise
• incident response
• LLM agents
• cybersecurity benchmark
• forensic analysis