Review of System Design Approaches in Agentic Artificial Intelligence for Security Operations Centers

Аннотация

Security operations centers increasingly rely on agentic artificial intelligence systems, which combine large language model reasoning with tool invocation and multi-step planning, to automate alert triage, investigation, and response. Independent research groups have proposed structurally distinct architectures for this purpose, ranging from single-agent reasoning loops to multi-agent systems with shared context or deterministic safety constraints, but no publication has systematically compared these designs against a common set of criteria. This review addresses that gap by constructing a five-dimension classification framework covering agent cardinality, coordination mechanism, autonomy boundary, safety enforcement layer, and validation maturity. A corpus of published systems relevant to security operations was retrieved from academic preprint archives and conference proceedings and coded against this framework. Five recurring design patterns were identified, together with the available quantitative evidence comparing them, including a controlled trial showing that multi-agent orchestration produced consistently reliable recommendations while single-agent approaches did not. The analysis found that claimed autonomy consistently outpaced empirical validation across the reviewed designs, with most systems evaluated no further than a single organizational deployment despite permitting autonomous action. These findings indicate that validation maturity should be assessed independently from architectural sophistication when organizations evaluate agentic artificial intelligence for security operations, and they identify calibration and human oversight effectiveness as priority areas for future empirical study.