Source-linked AI summary
A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes
Sahaya Jestus Lazer, Kshitiz Aryal, Maanak Gupta, Elisa Bertino
TL;DR
Agentic AI creates cybersecurity opportunities and risks that existing short-lived, non-autonomous governance and assurance approaches do not fully address. This survey synthesizes agentic cybersecurity threats, frameworks, evaluation pipelines, and representative implementations. Its central conclusion is that greater autonomy improves speed and adaptability but reduces predictability, auditability, and control.
Problem
Existing security, assurance, and governance approaches were largely designed for short-lived or non-autonomous systems, leaving agentic risks insufficiently addressed.
Method
The survey synthesizes agentic AI across cybersecurity workflows, analyzes systemic risks and governance frameworks, and presents three practical implementations.
Results
Greater autonomy improves speed and adaptability but reduces predictability, auditability, and control, with failures arising from system-level interactions beyond model inference alone.
Takeaways & Limitations
Agentic cybersecurity must be evaluated and governed at the system level, including interactions among perception, reasoning, action, memory, and identity.
Takeaways & Limitations
Existing frameworks, benchmarks, and governance approaches address parts of agentic cybersecurity but remain fragmented.
Abstract
from arXiv · showhide
Agentic AI marks an important transition from single-step generative models to systems capable of reasoning, planning, acting, and adapting over long-lasting tasks. By integrating memory, tool use, and iterative decision cycles, these systems enable continuous, autonomous workflows in real-world environments. This survey examines the implications of agentic AI for cybersecurity. On the defensive side, agentic capabilities enable continuous monitoring, autonomous incident response, adaptive threat hunting, and fraud detection at scale. Conversely, the same properties amplify adversarial power by accelerating reconnaissance, exploitation, coordination, and social-engineering attacks. These dual-use dynamics expose fundamental gaps in existing governance, assurance, and accountability mechanisms, which were largely designed for non-autonomous and short-lived AI systems. To address these challenges, we survey emerging threat models, security frameworks, and evaluation pipelines tailored to agentic systems, and analyze systemic risks including agent collusion, cascading failures, oversight evasion, and memory poisoning. Finally, we present three representative use-case implementations that illustrate how agentic AI behaves in practical cybersecurity workflows, and how design choices shape reliability, safety, and operational effectiveness.
1 Introduction
Agentic AI extends generative AI with persistent state, tool use, and self-directed control loops for long-lived workflows. In cybersecurity, these capabilities strengthen defense while amplifying offensive power and exposing gaps in existing governance and assurance models.
- Agentic AI and cybersecurity context: Agentic AI shifts AI systems from reactive, prompt-driven interaction toward persistent state, tool use, and self-directed control loops across long-lived workflows.These systems support planning, action, and revision rather than isolated generation.
- Agentic AI and cybersecurity context: Cybersecurity is especially aligned with agentic capabilities because operations require continuous monitoring, sequential decisions, tool coordination, and adaptation to adversarial behavior.Workforce shortages and operational pressure are also driving adoption of AI-assisted security solutions.
- Defensive applications: Agentic AI strengthens defense through automated alert triage, autonomous incident response, scalable red–blue simulation, and continuous SOC support.The survey also covers monitoring, anomaly detection, insider-threat detection, vulnerability management, and financial fraud defense.
- Dual-use risks: The same planning, memory, tool orchestration, and multi-agent interaction capabilities can enable autonomous reconnaissance, adaptive exploitation, coordinated social engineering, and oversight evasion.This creates a pronounced cybersecurity dual-use dilemma.
- Governance and systemic risk: Existing security, assurance, and governance models are limited because they largely assume short-lived, human-in-the-loop, or narrowly scoped systems.Agentic systems instead act continuously, retain long-term memory, coordinate with other agents, and make consequential decisions with reduced human supervision.
- Survey scope and contributions: The survey synthesizes defensive, offensive, and governance-oriented contexts while reviewing systemic risks, frameworks, benchmarks, evaluation pipelines, and three cybersecurity implementations.Its risk analysis includes collusion, synthetic insider threats, emergent behaviors, cascading failures, memory poisoning, and oversight evasion.
2 Related Work
Prior surveys provide taxonomies of agent threats, defenses, safety, and governance, but they generally lack an end-to-end cybersecurity-centered synthesis. This survey organizes the agentic stack and its risks across defensive, offensive, and enterprise workflows.
- Scope of prior surveys: Existing surveys address LLM safety, agent security, communication protocols, autonomous cyberattacks, governance, and evaluation from several complementary perspectives.Their coverage includes security, privacy, defenses, trust, risk, and responsible agentic reasoning.
- Gaps in prior work: Many prior works are domain-agnostic or do not organize analysis around defensive monitoring, adversarial interaction, and enterprise security workflows.This limits their cybersecurity-operations focus despite useful agent-level threat models and defenses.
- Gaps in prior work: Cybersecurity-specific reviews are closer in domain but do not analyze the full LLM-agent stack of planning loops, tool use, memory systems, and multi-agent orchestration.The stated gap concerns end-to-end treatment of autonomous cybersecurity operations.
- This survey's framing: This survey treats agentic AI as a cybersecurity system that reasons, plans, uses memory, and calls tools across extended tasks.It applies a consistent risk lens across defensive, offensive, and enterprise workflows.
- This survey's framing: The survey additionally analyzes collusion, cascade failures, and oversight evasion and prototypes minimal implementations to illustrate feasibility in cybersecurity.These additions connect system-level risks with practical cybersecurity workflows.
3 What is Agentic AI?
Agentic AI extends GenAI with planning, action, memory, tool use, and iterative adaptation for multi-step tasks. Its increasing autonomy supports scalable collaboration but makes behavior harder to predict, audit, and secure.
- Core concept: Agentic AI extends GenAI with planning, action, memory, and adaptation across long tasks rather than producing a single response.Its systems combine a foundation model with memory, retrieval, and tool interfaces in continuous planning, acting, reflecting, and improving loops.
- Architectures: Single-agent architectures execute planning, action, and tool-calling loops with short-term memory and external services, while multi-agent systems route subtasks among specialized agents sharing memory and infrastructure.The multi-agent separation supports parallel reasoning, structured collaboration, and scalable problem solving.
- Core capabilities: Agentic systems use reasoning, tool and environment interaction, autonomy, and feedback-driven adaptability to pursue goals over extended time scales.These capabilities include decomposing problems, calling tools or querying data, initiating actions with limited supervision, and updating behavior from memory or feedback.
- Autonomy spectrum: Agentic systems span five autonomy levels, from fixed GenAI behavior at Level 0 to continuous planning and self-directed learning at Level 4.Higher autonomy improves capability but increases complexity and security risk because behavior becomes harder to predict and audit.
- Cybersecurity implications: In cybersecurity, agentic AI can strengthen continuous monitoring and proactive defense while increasing safety, oversight, trust, and responsibility challenges.The paper therefore frames careful design and testing as essential, especially because agentic AI is not universally reliable and social reasoning remains difficult.
4 Applications of Agentic AI to Cybersecurity
Agentic AI applications span the cybersecurity lifecycle, from continuous monitoring and detection through response, enterprise automation, threat intelligence, and simulation. Across these domains, systems improve coordination and context retention, but reliable deployment depends on bounded autonomy, human oversight, and governance.
- Lifecycle coverage: Agentic AI supports the cybersecurity incident lifecycle through preparation, detection and containment, and recovery and resilience.Applications include vulnerability management, SOC agents, automated response, post-incident analytics, root-cause analysis, and adaptive retraining.
- Lifecycle coverage: A modular multi-agent design assigns agents to narrow defense functions, reducing action space, simplifying training, and improving scalability compared with end-to-end autonomy.The design aligns agents with NIST Cyber Defense functions and SOC workflows.
- Autonomous monitoring and detection: Agentic monitoring extends static detection by retaining context across events, expanding analysis to related entities, and triggering log retrieval or cross-system correlation.These systems use memory and planning to adapt monitoring as conditions change, whereas classical monitoring relies on predefined rules and data streams.
- Autonomous monitoring and detection: Agentic systems can rapidly detect and contain threats, but irreversible actions require authorization boundaries, auditable logs, escalation protocols, and failure containment.Reasoning-driven systems still lack formal safety guarantees under distribution shift or adversarial manipulation.
- Threat intelligence and enterprise automation: Across applications, autonomy creates a flexibility-control tradeoff: exploration uncovers more attack paths, while structure and containment limit misuse but constrain discovery.Workflow-oriented platforms favor rapid response, whereas narrower systems emphasize accuracy, robustness, and explanation without naturally extending to remediation or cross-domain defense.
- Enterprise automation and simulation: Reported systems improve analyst capacity, workflow orchestration, configuration correctness, and deployment success, but remain sensitive to distribution shift, false positives, and misaligned incentives.The surveyed literature presents augmentation, rather than replacement, as the dominant design pattern, with autonomy bounded by governance, auditability, and escalation mechanisms.
- Enterprise automation and simulation: Cyber ranges and coordinated agents improve iteration speed, deployment success, and reproducibility, while detailed configuration requirements and simplified environments constrain comparability and realism.These environments support controlled simulation-to-real transfer within defined settings but can restrict agent actions and simplify targets.
5 Agentic AI-Enabled Cyber Attacks
Agentic AI strengthens cyber offense by automating reconnaissance, exploitation, coordination, ransomware, and fraud workflows, while compressing attack timelines and reducing direct human oversight. These capabilities create a persistent tradeoff between operational scale and control.
- Insider Threats and Autonomous Exploits: Agentic systems can perform reconnaissance, discover vulnerabilities, and execute multi-stage intrusions with limited human involvement, increasing cybercrime speed and reach.Industry reporting describes agent-driven reconnaissance, adaptive malware, and large-scale automation.
- Insider Threats and Autonomous Exploits: Greater autonomy increases coverage and efficiency but also expands the impact of misalignment, compromise, and trusted-agent misuse under valid identities.Existing defenses may detect misuse only after it begins, leaving prevention of accidental or adversarial misuse unresolved.
- Agentic AI for Ransomware Operations: Agentic ransomware is best understood as an escalation of automation and decision autonomy rather than a fundamentally new cryptographic or exploit class.This framing shifts attention toward detecting and interrupting autonomous attack loops before lateral propagation and exfiltration complete.
- Agentic AI for Ransomware Operations: Agents adapt ransomware attack sequences using tool output, environmental feedback, and access constraints rather than changing the underlying payload.They can select alternative reconnaissance, privilege-escalation, or exfiltration strategies when actions fail.
- Social Engineering and Financial Fraud: Agentic fraud systems maintain memory, adjust tactics during interaction, and coordinate multi-step activity, increasing reach and consistency while reducing human judgment.ScamAgents demonstrated multi-turn scam calls that adapt to user responses and evade refusal mechanisms and prompt-level content filters.
6 Security of Agentic AI
Agentic AI expands the security problem from model behavior to systems that maintain state, execute tools, and coordinate workflows across sessions. The surveyed frameworks organize these risks across layers and controls, but coverage remains fragmented and runtime enforcement incomplete.
- System-Level Security Risks: Agentic systems expand the attack surface through persistent state, tool execution, external APIs, multi-step workflows, and open-ended natural-language goals.Risks include large-scale exfiltration, supply-chain compromise, and difficult-to-predict emergent behavior.
- Layered Security Models: The four-layer model maps threats and defenses across perception, reasoning, action, and memory, while emphasizing that failures can propagate across stages.Representative risks include poisoning at perception, manipulation at reasoning, unsafe tool use at action, and poisoning or leakage in memory.
- Security Frameworks: MAESTRO connects models, data flows, orchestration, infrastructure, and governance to threats such as embedding poisoning, collusion, and model theft.NetMoniAI reports improved detection timeliness using memory isolation, planner validation, and anomaly monitoring, although evaluations remain system specific.
- Runtime Enforcement and Governance: Runtime mechanisms enforce policy checks, identity verification, and decentralized logging, but assume correct policy specifications and trusted identity layers.Governance-oriented approaches add provenance, trust calibration, and auditable oversight while deferring technical enforcement to underlying systems.
- Security Frameworks: No single framework connects autonomy, lifecycle risks, and runtime enforcement into one integrated stack.The survey identifies weaker coverage for action enforcement, multi-agent interaction, and resource governance than for perception and reasoning.
- Executable Agent Risks: Over 75% of malicious commands executed successfully without sandboxing, whereas container-based sandboxing blocked nearly all such commands.This result illustrates the action-level exposure created when model-generated programs execute without adequate isolation.
6.3 Prompt Injection and Tool Invocation Risks
Prompt injection is both an input-validation problem and an authority-orchestration problem because untrusted content can steer tool calls across services. Mitigations reduce specific failure modes, but broad access, cascading effects, and adaptive attacks leave important gaps.
- Prompt Injection and Tool Invocation Risks: Prompt injection grows with agent autonomy because malicious prompts and untrusted external data can override goals and redirect behavior in multi-tool workflows.The resulting risk is amplified when agents access shared interfaces, databases, and external services.
- Prompt Injection and Tool Invocation Risks: Weak authentication, broad scopes, and poor rate limits can let attackers escalate privileges through agent workflows and trigger runaway costs or denial of service.Database-connected agents may also construct unsafe queries when malicious prompts or retrieved content influence SQL generation.
- Prompt Injection and Tool Invocation Risks: Broad tool access increases the blast radius of a single injection, whereas narrow scopes and strict delegation reduce exposure at the cost of autonomy and overhead.Scoped credentials limit blast radius after compromise but do not prevent harmful actions that remain permitted.
- Prompt Injection and Tool Invocation Risks: Layered mitigations combine sanitization, scoped credentials, runtime monitoring, and intent-bound delegation across the prompt-to-action pipeline.Agentic JWT delegation binds actions to authenticated intent and reduces escalation once injected instructions reach the action layer.
- Prompt Injection and Tool Invocation Risks: Sanitization and filtering reduce obvious injections but fail against semantic, multimodal, or steganographic attacks that preserve benign surface meaning.Least-privilege controls and post-hoc monitoring likewise leave gaps against permitted harmful actions and cascading cross-tool effects.
- Prompt Injection and Tool Invocation Risks: Many benchmarks evaluate isolated injection paths rather than cascading failures across APIs, databases, and services, and many defenses assume cooperative environments.Adaptive attackers and cross-service interactions therefore remain underrepresented in evaluation.
- Multi-Agent Security, Collusion, and Information Flow: Multi-agent security controls trade harmful-behavior reduction against collaboration efficiency and task performance, a tradeoff termed the multi-agent security tax.Reasoning-based defenses inspect cognition, while infrastructure-oriented defenses monitor coordination and information flow independently of agent reasoning.
- Multi-Agent Security, Collusion, and Information Flow: Infrastructure-oriented approaches improve detection coverage without assuming cooperative agents, but they incur monitoring and computational overhead and may reduce responsiveness.Existing defenses are often evaluated under partially trusted agents or static interaction patterns.
6.5 Autonomy, Identity, Governance, and Resources
Security outcomes depend on how autonomy, identity, governance, and resource controls bound agent actions. The surveyed approaches consistently trade adaptability and efficiency against blast-radius reduction, auditability, and operational overhead.
- Identity and Access Control: Hierarchical, task-specific privileges separate planning, querying, and execution, reducing prompt-injection and goal-manipulation impact by limiting what agents can execute.These results show that execution boundaries shape the scale of failure.
- Autonomy and Execution Boundaries: Higher autonomy improves speed and coverage, while bounded autonomy limits blast radius at the cost of adaptability.Current deployments therefore favor restricted autonomy and continued human oversight for safety.
- Governance and Accountability: Agents acting without explainable decision paths or explicit refusal mechanisms can propagate failures quickly and make attribution difficult in dual-use actions.Refusal and escalation safeguards improve accountability but constrain flexibility and increase reliance on human oversight.
- Identity and Governance: Identity mechanisms must support auditability in addition to authentication because incomplete provenance weakens accountability and increases unauthorized data-exposure risk.Database-connected agents often lack complete audit trails for agent-initiated queries under GDPR and CCPA.
- Identity and Governance: Identity, registry, and enterprise approaches trade decentralization against deployability and privacy against accountability.These tradeoffs appear across decentralized identifiers, verifiable credentials, registries, trust scoring, and enterprise workload-identity models.
- Identity and Governance: Most identity systems are evaluated in pilots rather than sustained adversarial settings, and identity alone does not prevent misuse when execution boundaries are weak.Scaling real-time trust scoring and enforcement without prohibitive latency or operational burden remains open.
- Resource Governance: CRABS-style attacks exploit syntactically valid prompts to induce excessive token generation, long reasoning chains, and repeated tool calls that evade traditional rate-based defenses.Related concurrency attacks exhaust compute and tokens through coordinated workloads across agents.
- Resource Governance: Adaptive budgeting and dynamic quotas regulate tokens, runtime, and API calls through throttling or termination, improving availability while reducing output quality.Circuit breakers preserve availability but can sacrifice task completion, and resource controls require careful tuning.
6.6 Assurance, Testing, and Infrastructure
Assurance for agentic AI must address dynamic action spaces, adaptive adversaries, long-horizon learning, and cross-agent coordination rather than rely on one-time validation. The surveyed approaches reveal recurring tradeoffs between experimental control, scenario generation, oversight, scalability, and operational speed.
- Assurance and testing: Agentic assurance requires shared infrastructure, continuous evaluation, and governance across institutional boundaries because agents operate dynamically and expand their action space over time.Adaptive red-team methods probe reasoning, coordination, and tool use, but evolving adversary behavior reduces comparability.
- Infrastructure: Cyberwheel, ARCeR, and related testbeds improve repeatability, transfer, setup cost, or scenario coverage, but depend on simulation fidelity, retrieved knowledge, configuration quality, and sustained investment.Together, these systems expose a tradeoff between experimental control and rapid scenario generation.
- Assurance and testing: Static benchmarks are insufficient for adaptive systems, while current testbeds abstract human-oversight delays and long-term learning effects.The surveyed infrastructure therefore still lacks standardized assurance signals that remain comparable as agents and environments evolve.
- Agentic attack surfaces: Reasoning hijacking, action hijacking, and memory poisoning can redirect decisions, expose internal structure, or influence future tasks long after an attack ends.These attacks occur inside decision loops and connect reasoning, action, and persistent state, bypassing input-focused defenses.
- Human-agent risk: Agentic social engineering combines browsing, form filling, account interaction, multimodal adaptation, phishing, voice calls, and persistent deception.Human-agent monitoring improves coverage over training-based defenses but introduces privacy concerns, operational overhead, and reliance on continuous telemetry.
- Governance and oversight: Human oversight, approval gates, attributable execution, interruptibility, and continuous monitoring improve accountability but reduce throughput and scalability.Weaker oversight increases speed at the cost of error amplification, while current defenses struggle with long-horizon trust manipulation, intent drift, and cross-channel coordination.
6.8 Benchmarks for Agentic AI Security
Agentic AI security benchmarks must test behavior under adversarial inputs, unsafe environments, and constrained defenses across reasoning, tools, and multiple agents. Existing approaches balance breadth, diagnostic precision, automation, fidelity, scalability, and maintenance cost.
- Evaluation scope: Security evaluation requires benchmarks covering adversarial inputs, unsafe environments, and constrained defenses rather than only general agent capabilities.Security-focused suites target failures such as indirect prompt injection, sanitizer bypass, unsafe tool use, and multi-agent escalation.
- Benchmark landscape: Existing systems span system-level lifecycle and economic-impact benchmarks, scenario-driven environments for planning and tool use, and domain-specific evaluations for regulated settings.These styles differ in scope, realism, and diagnostic ability.
- Benchmark tradeoffs: Broad benchmarks capture lifecycle effects and cross-layer interactions, whereas narrow benchmarks provide controlled comparison and reproducibility but miss failure propagation.This is the recurring breadth-versus-diagnostic-precision tradeoff.
- Benchmark tradeoffs: Automated range generation improves coverage and repeatability, while manually curated systems better reflect practice but limit diversity and update speed.Automation can hide real-world fragility through abstractions.
- Open problems: Current benchmarks weakly cover adaptive adversaries, long-horizon learning, and sustained multi-agent coordination.The open problem is integrating complementary benchmarks into shared protocols that remain reproducible, adversarial, economically meaningful, and affordable to operate.
7 Quantum Computing and Agentic AI in Cybersecurity
Quantum computing challenges the classical cryptographic, computational, and communication assumptions underlying agentic AI. The surveyed work shows conceptual and detection-level progress, but current approaches do not yet resolve secure autonomy, persistent state, coordination, and trust under realistic constraints.
- Motivation and scope: Quantum computing weakens the stable-cryptography, classical-computation, and predictable-communication assumptions of conventional agentic AI.Research addresses quantum-native agents, quantum learning for security, and quantum-resilient trust and governance.
- Operational limitations: Quantum agent models clarify quantum autonomy conceptually but do not yet specify interactions with tools, external systems, persistent memory, or deterministic interfaces.These omissions limit direct operational use in cybersecurity workflows.
- Quantum agents: QMARL and eQMARL study quantum-enhanced multi-agent coordination, with reported faster convergence, lower coordination overhead, and reduced reliance on centralized control.These studies generally assume trusted agents and ideal communication, conditions that cybersecurity environments violate.
- Quantum security experimentation: Quantigence provides infrastructure for controlled experimentation with quantum-enabled agents under security assumptions rather than claiming algorithmic performance or empirical security outcomes.Its contribution is to model compromise, deception, and trust failure before quantum advantage is claimed.
- Quantum learning for security: Quantum cybersecurity analytics demonstrate feasibility but remain sensitive to data structure, error tolerance, hardware noise, and scalability, with classical methods still competitive under realistic constraints.Existing quantum machine-learning studies typically evaluate classifiers in isolation rather than planning latency, decision stability, or downstream autonomous response.
- Quantum-resilient trust: Agentic systems and post-quantum cryptography remain mismatched because agents are persistent and autonomous while much post-quantum research assumes short-lived or stateless clients.The literature does not yet resolve how to preserve autonomy, persistence, and coordination as cryptographic assumptions evolve.
8 Prototype Agentic AI Implementations for Cybersecurity
Three minimal, safety-oriented prototypes illustrate agentic cybersecurity workflows using simulated configurations, synthetic logs, policy controls, audit logging, and lightweight local models. Across red-blue simulation, SOC triage, and anomaly detection, the prototypes demonstrate adaptive behavior while retaining controlled evaluation boundaries.
- Prototype design: All three prototypes use lightweight local models, simulated or synthetic inputs, structured outputs, policy gates, and audit logs to support reproducibility and safety.These design choices constrain operational scope while illustrating how agentic workflows can be evaluated in cybersecurity settings.
- Adaptive red-blue simulation: The red-blue prototype autonomously generates attacks and defenses from a static system configuration and high-level role instructions.Agents select vulnerabilities, attack vectors, countermeasures, and post-exploitation strategies without user-specified steps or fixed defenses.
- Adaptive red-blue simulation: In Round 2, both red and blue agents adapt their strategies to the opponent’s prior behavior without additional user guidance.The textual loop represents escalation, defense-posture tuning, and adversarial persistence.
- Anomaly and IDS agent: The anomaly/IDS agent combined statistical features with retrieval-augmented notes to distinguish benign periodic traffic from volumetric anomalies.The prototype produced structured labels and concise rationales, whereas traditional detectors could generate false positives when periodicity resembled malicious activity.
- Anomaly and IDS agent: The anomaly/IDS agent achieved an average explanation-usefulness score of 0.83 while maintaining high recall and improving F1.Its outputs were evaluated with a rubric covering explanation consistency and specificity.
9 Directions of Future Research
Future research should close the gap between agent capabilities and security guarantees through adaptive inspection, transparent execution, robust planning, secure interaction, coordination, memory, evaluation, and governance.
- Agentic AI security remains an open research problem because defensive solutions are still limited.
- Input inspection and control: Adaptive inspection should operate during interaction, distinguish instructions from data, and handle multistep and multimodal inputs.Existing heuristic filters and offline analysis do not scale well to real-time execution.
- Transparency of internal execution: Execution traces and structured logging can support runtime verification and post hoc auditing of agent behavior.Internal reasoning, planning, and tool calls are often hidden from auditors, limiting timely detection of unsafe behavior.
- Robust planning and reasoning: Future work should develop constrained planning and formal policies that limit error propagation and enforce safety rules throughout execution.Current planning structures lack formal guarantees, while combining language models with verifiable policies remains an open challenge.
- Secure interaction with environments: Secure agent deployment requires stronger isolation from external data, sandboxing, environment validation, and secure coordination protocols.Dynamic environments expose agents to indirect prompt injection and manipulated feedback, while multi-agent systems may collude, deceive, or propagate errors.
- Memory, evaluation, and governance: Research should develop secure memory architectures, comprehensive benchmarks, and assurance frameworks combining technical, organizational, and governance controls.Needed capabilities include memory validation, versioning, access control, privacy-preserving retrieval, reproducible evaluation, policy enforcement, auditing, and human oversight.
10 Conclusion
Agentic AI brings memory, tool use, and autonomy to cybersecurity workflows, but persistent state, execution authority, and coordination create novel systemic risks. The survey concludes that autonomy improves speed and adaptability while reducing predictability, auditability, and control, requiring bounded autonomy and enforceable controls.
- Agentic AI shifts cybersecurity from static inference toward systems that reason, act, and adapt over time.
- Memory, tool use, and autonomy enable cybersecurity capabilities across monitoring, response, intelligence, and training while introducing risks from persistent state and execution authority.
- Greater autonomy improves speed and adaptability but reduces predictability, auditability, and control.
- Security failures arise from interactions among perception, reasoning, action, memory, and identity, while existing frameworks and benchmarks remain fragmented.
- Security and governance should be foundational design requirements supported by bounded autonomy, enforceable execution controls, continuous assurance, and human oversight.