Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning

2026-08-03

AI Summary

This work addresses the inefficiency of traditional manual security incident response and the limitations of existing automated approaches, which are either difficult to deploy or suffer from unreliable planning due to hallucinations when relying solely on large language models (LLMs). To overcome these challenges, the paper proposes a novel multi-scale intelligent response architecture that integrates decision-theoretic planning with a lightweight LLM. The framework uniquely combines digital twins, a tactical-level rollout planner, and an operational-level LLM agent, establishing a dual-scale (tactical–operational) coordination mechanism to enable reliable and executable automated responses in simulated environments. Experimental results across three attack scenarios demonstrate that the proposed approach reduces average recovery time by 15.1% and improves success rate by 33.6% compared to state-of-the-art LLM-based baselines.

Abstract

Incident response is currently managed by security operators using predefined playbooks, resulting in slow, labor-intensive security decision-making processes. Consequently, there is a growing need for automated incident response planning. Decision-theoretic approaches based on control, optimization, and reinforcement learning have been proposed to automate such planning tasks with well-grounded approaches, yet most of which, while guaranteeing strong performance, are limited to abstract models and cannot be directly applied to operational systems. A promising approach to mitigate this limitation is to use the security knowledge embedded in large language models (LLMs) to develop agentic response systems. However, current agentic approaches rely on repeated invocations of the LLM to generate a response plan, which is unreliable and limits the planning horizon due to hallucination. In this paper, we develop a principled LLM-based planning method by combining decision-theoretic planning with LLM-generated response commands. The proposed agentic incident response approach uses a rollout planner to compute a high-level response strategy that allocates security resources (the tactical scale), which is then translated into executable commands by a lightweight LLM agent (the operational scale). Within this architecture, we use a digital twin that supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios, our agentic approach reduces recovery execution time by 15.1\% on average and increases the recovery rate by 33.6\% over frontier LLM baselines.

Problem

• incident response
• automated planning
• large language models
• decision-theoretic planning
• digital twin

Innovation

• Digital Twin
• Multiscale Planning
• Agentic Incident Response
• Decision-Theoretic Planning
• Large Language Models