Paper deep dive
Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning
Yiran Gao, Tao Li, Kim Hammar
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Incident response is currently managed by security operators using predefined playbooks, resulting in slow, labor-intensive security decision-making processes. Consequently, there is a growing need for automated incident response planning. Decision-theoretic approaches based on control, optimization, and reinforcement learning have been proposed to automate such planning tasks with well-grounded approaches, yet most of which, while guaranteeing strong performance, are limited to abstract models and cannot be directly applied to operational systems. A promising approach to mitigate this limitation is to use the security knowledge embedded in large language models (LLMs) to develop agentic response systems. However, current agentic approaches rely on repeated invocations of the LLM to generate a response plan, which is unreliable and limits the planning horizon due to hallucination. In this paper, we develop a principled LLM-based planning method by combining decision-theoretic planning with LLM-generated response commands. The proposed agentic incident response approach uses a rollout planner to compute a high-level response strategy that allocates security resources (the tactical scale), which is then translated into executable commands by a lightweight LLM agent (the operational scale). Within this architecture, we use a digital twin that supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios, our agentic approach reduces recovery execution time by 15.1\% on average and increases the recovery rate by 33.6\% over frontier LLM baselines.
Tags
Links
- Source: https://arxiv.org/abs/2608.02422v1
- Canonical: https://arxiv.org/abs/2608.02422v1
Trouble viewing inline? Open PDF directly →
Full Text
61,814 characters extracted from source content.
Expand or collapse full text
Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning Yiran Gao 1 , Tao Li 1 , and Kim Hammar 2 1 City University of Hong Kong, Hong Kong SAR gaoyiran525@gmail.com, li.tao@cityu.edu.hk 2 Imperial College London, United Kingdom k.hammar@imperial.ac.uk Abstract. Incident response is currently managed by security operators using predefined playbooks, resulting in slow, labor-intensive security decision-making processes. Consequently, there is a growing need for au- tomated incident response planning. Decision-theoretic approaches based on control, optimization, and reinforcement learning have been proposed to automate such planning tasks with well-grounded approaches, yet most of which, while guaranteeing strong performance, are limited to abstract models and cannot be directly applied to operational systems. A promising approach to mitigate this limitation is to use the secu- rity knowledge embedded in large language models (LLMs) to develop agentic response systems. However, current agentic approaches rely on repeated invocations of the LLM to generate a response plan, which is unreliable and limits the planning horizon due to hallucination. In this paper, we develop a principled LLM-based planning method by com- bining decision-theoretic planning with LLM-generated response com- mands. The proposed agentic incident response approach uses a rollout planner to compute a high-level response strategy that allocates security resources (the tactical scale), which is then translated into executable commands by a lightweight LLM agent (the operational scale). Within this architecture, we use a digital twin that supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios, our agentic approach reduces recovery execution time by 15.1% on average and increases the recovery rate by 33.6% over frontier LLM baselines. Keywords: Network intrusion response· Response planning· Rein- forcement learning· Large language model· Digital twin. 1 Introduction Incident response refers to the coordinated actions taken to contain, mitigate, and recover from cyberattacks. Today, incident response is largely a manual process carried out by security operators. Though this approach can be effective, it is often slow and requires specialized skills. For instance, a recent report by IBM indicates that 60% of the surveyed organizations take more than 100 days to respond and recover from security incidents in networked systems [24]. arXiv:2608.02422v1 [cs.CR] 3 Aug 2026 2Gao, Y., Li, T., and Hammar, K. To address the limitation of manual security operations, autonomous cy- ber defense (ACD) has emerged as a promising approach for developing agents that can respond to attacks without human intervention [49,43,35]. For incident response planning, existing ACD methods typically rely on abstract decision- making models and simulators; see, e.g., [39]. By converting the networked sys- tem into an abstract simulation (e.g., a Markov decision process [40,36,51]), these methods make the planning problem tractable and leverage control and optimization, game theory, and reinforcement learning (RL) to compute optimal plans. Yet, this abstraction also limits the practical applicability of the resulting response plans. In particular, response plans produced by current ACD meth- ods operate at the tactical scale: they prescribe high-level defensive actions (e.g., defend this host) without specifying the implementation at the operational scale. A promising approach to close this gap is to use a large language model (LLM) to automatically generate an operational response plan, i.e., one that includes executable commands for a networked system. Unlike abstract decision- theoretic agents, LLM agents can process large volumes of system logs and gener- ate executable system commands [53]. However, current LLM-based approaches rely mostly on prompt engineering of general-purpose LLMs without principled planning algorithms, which is unreliable and prone to hallucinations [42,6,37]. To address these limitations and bridge the gap between the tactical and op- Security alerts Decision-theoretic planner (tactical scale) LLM agent (operational scale) Digital twin Response strategy Response commands Verified response plan Operational feedback s 1,1 s 1,2 s 1,3 s 2,1 s 2,2 s 2,3 s 3,1 s 3,2 s 3,3 Fig. 1: Illustration of our multiscale approach to agentic incident response plan- ning. Tactical scale: We employ a decision-theoretic planner to generate a high- level response strategy. Operational scale: We use a Large Language Model (LLM) agent to translate the high-level strategy into executable commands and verify them in a digital twin. erational scales, we propose combining decision-theoretic planning with LLM- based response generation; see Fig. 1. On the tactical scale, we use the lookahead rollout method, a major RL approach [31,5], to compute a high-level response strategy based on an abstract model. This strategy is then fed to an LLM agent, which operates at the operational scale by grounding it in the system context and translating it into an executable response plan. This separation allows the planner to provide tactical guidance, while the LLM handles the system-specific details required for execution. Within this multiscale planning framework, we use a digital twin (i.e., a vir- tual replica of the system affected by the incident) that supports tactical plan- ning through simulation and operational execution through emulation [18]. In Agentic Incident Response Multiscale Planning3 particular, simulation enables computationally efficient planning at the tactical scale by abstracting system details and simulating attack progression across the network, while emulation enables operational-scale response action verification by allowing testing of the generated response plan before deployment. We implement our multiscale architecture on a testbed network comprising five servers (Fig 3) and use it to recover the networked system under three attack scenarios that exploit diverse vulnerabilities across servers. In contrast to LLM agents proposed in prior work [42,6,37], our implementation can be deployed locally and does not rely on an external LLM provider. In particular, we fine-tune the Deepseek-R1-14B LLM [17] on an open-source dataset of 68, 000 incidents and their corresponding responses. Despite being so lightweight (14B parameters compared to≈ 800B), we show that our system outperforms frontier LLMs by 15% on average across the attack scenarios we evaluated, in terms of recovery time. Moreover, it outperforms frontier LLM baselines by 15.1% on average in recovery execution time, while maintaining a success rate over 90% across distinct scenarios. Our contributions are as follows. – We formulate the incident response as a factorized Markov decision pro- cess that separates the network-level, tactical-scale planning from the server- specific, operational-scale planning. – We develop an agentic incident response framework that integrates decision- theoretic rollout planning at the tactical scale with LLM-based generation verified by a digital twin at the operational scale. – We implement our architecture using a lightweight LLM and demonstrate that it outperforms the state of the art in recovery-action execution time and success rate for three multi-stage attacks. 2 Related Works Decision-theoretic incident response. Since incident response can be viewed as a sequential decision-making process, there have been considerable and on- going efforts to apply control, optimization, and, most recently, reinforcement learning (RL) methods to incident response. The general recipe, which can be traced back to [26], is to first model the response process as a discrete-time control system, where the system state encapsulates the network security pos- ture and control actions are security responses; examples include the Markov decision process (MDP) [49] and the Markov game [2,32], among others. Then, the optimal response plan corresponds to the optimal policy of the sequential decision-making models. Recent developments [23,41] have actively engaged with robust control and optimal control to achieve optimal response planning in the offline design, while online learning [21,20], meta learning [15] and multi-agent learning [29,34] have also been explored recently for online adaptive planning. Related to control- theoretic response planning, RL has emerged as a promising paradigm for data- driven optimal control when closed-form modeling of the network system is un- 4Gao, Y., Li, T., and Hammar, K. available [33]. However, RL still relies on an accurate simulator of the target system, which is rarely available in practice. LLM-based approaches for incident response. A promising approach to address the drawbacks of decision-theoretic approaches is to use large language models (LLMs) to automatically generate effective response actions from system logs. This approach is not limited to a predefined set of actions and eliminates the need for a simulator. Early studies in this direction include [42,37,36,50]. These approaches can be separated into two categories: prompt-based LLM or- chestration and LLM-RL hybrid approaches. The first category decomposes incident response into several subtasks and develops tailored prompts for LLMs for tackling each task [42,37]. While these works report encouraging results, they have three key limitations: they do not leverage principled planning techniques, they rely on extensive prompt tuning, and most require uploading incident data to external LLM providers. The second category addresses some of these limitations by combining RL and LLM agents, where RL agents supervise the LLM generation [52], LLM agents augment RL agents through knowledge sharing [38], and two agents com- municate with each other [6]. Despite the different nature of agentic interactions, these works require additional RL training and LLM-RL joint operations in a simulated environment, leaving a gap between simulation and practical imple- mentation. Most relevant to our work is a line of recent work on integrating decision-theoretic planning with LLM generation [19,13]. However, these ap- proaches use planning methods, e.g., rollout and Monte Carlo tree search, to guide LLM-generated operational response actions. Digital twins in cybersecurity. The concept of digital twins (DTs) originated in the manufacturing, aviation, and physical AI sectors [16,30], where a digital replica runs in parallel with the physical process, offering real-time situational awareness [16,28]. In the context of cybersecurity, DTs provide two main kinds of functionalities: emulation and simulation; see e.g., [9,12,1,10,45,46,11]. Emu- lation aims to reproduce the target system’s functions and timing behavior in a virtual replica. Such a virtual replica can be used for digital forensics before real-world forensics takes place [9] and for visualizing vulnerabilities [12]. More importantly, it provides a controlled environment for virtual operations, with outcomes that can be used to optimize operations in the target system [46], such as event management [10] and incident prediction [45]. In contrast, simulation is a lightweight abstraction that models selected system aspects to explore security scenarios without reproducing the behavior of the full target system [18]. Novelty of our approach. To our knowledge, we are the first to combine tactical planning with operational response generation, whereas prior work fo- cuses on either tactical planning or operational response generation in isolation. Compared with the most relevant works [19,13], our work features integrated tactical-operational planning that goes beyond LLM-based planning and is aug- mented with digital-twin verification. Moreover, unlike prior work that typically uses digital twins for either simulation or emulation, our method uses both: simu- lation for tactical-scale planning and emulation for operational-scale verification. Agentic Incident Response Multiscale Planning5 Finally, by fine-tuning a local LLM, as in our previous work [13], our approach is more lightweight and reduces dependence on external LLM providers. 3 Preliminaries This section presents basic definitions that will be used in the subsequent section covering our methodology. We first describe the main stages of incident response and then review partially observable Markov decision processes (POMDPs) as a formal model for planning under partial observability. Incident Response Planning. Incident response involves selecting a sequence of actions to restore a networked system to a secure, operational state after a cy- berattack. These actions should analyze the scope of the attack, secure forensic evidence, contain and evict the attacker, harden the system to prevent recur- rence, and restore critical services. Examples of response actions include redi- recting network flows, updating access control policies, patching vulnerabilities, shutting down compromised systems, and restarting operational services. We model the system affected by the incident using a graph G =⟨V,E⟩. The node set V≜ 1, 2,...,N includes N components, and their interconnections are denoted by the edge set E. The system operator, which we refer to as the defender, monitors the system using infrastructure statistics from an intrusion detection system (IDS). Once an attack has been detected, the defender’s task is to plan a sequence of actions to restore the system to a secure, operational state as quickly as possible. Following the MITRE D3FEND taxonomy [25], we divide the incident re- sponse process into the following six stages. 1. Containment: isolating the attack and preventing it from spreading to other connected components. 2. Assessment: identifying the scope and severity of the attack. 3. Preservation: preserving forensic evidence for analysis. 4. Eviction: revoking the attacker’s access to the system. 5. Hardening: patching vulnerabilities and hardening the system to prevent recurrence of the attack. 6. Restoration: restoring services and user access. The goal of the defender is to find a sequence of actions that drives the affected system through these response stages as quickly as possible while minimizing operational costs. A key challenge in selecting such actions is that the available information about the attack is often limited to partial indicators of compromise, e.g., IDS alerts. Moreover, the attacker’s tactics are generally unknown. Partially Observable Markov Decision Processes. Given the partial ob- servability of the system’s security state, we formulate incident response planning as a partially observable Markov decision process (POMDP). We briefly review the formalism of POMDPs for a general use case, deferring the details of our multiscale planning system model to the next section. A POMDP evolves over time steps t = 0, 1, 2,.... At each time step t, the system’s security status is represented by the unobservable state variable s t . The 6Gao, Y., Li, T., and Hammar, K. defender has access to an observation o t that represents system metrics correlated with the recovery state (e.g., log files and IDS alerts). Specifically, the correlation between states and observations is modeled by an observation kernel O(o t | s t ), which defines the probability of observing o t in state s t . At each time step t, a response strategy π prescribes an action a t = π(o 0:t ) that influences the system’s state evolution according to the Markov transition kernel P θ , where θ denotes the attacker’s tactics and P θ (s t+1 | s t ,a t ) specifies the probability of transitioning to state s t+1 when executing response action a t in state s t . We assume the existence of an absorbing terminal state s T such that P θ (s T | s T ,a) = 1 for all actions. This state models the operating conditions when the system has fully recovered and remains operational thereafter. The time required to implement each response action may vary. For example, isolating a compromised host may take a few seconds, while performing forensic analysis of affected systems may last several hours. We model this time through a cost function c, where c(s t ,a t ) represents the time to execute response action a t in state s t . Naturally, c(s T ,a) = 0 for all response actions a, since the terminal state does not require any response. Given this cost function, the problem of minimizing the recovery time can be expressed as min π E P θ ,π h P H t=0 c(s t ,a t ) i , where H is a finite time horizon. 4 Formalizing the Incident Response Use Case We formulate incident response as a planning process at two levels: (i) tacti- cal planning for allocating security resources to system components; and (i) operational planning of recovery actions for those components. To capture this two-level planning mathematically, we model incident response as a factorized POMDP where the state s t is decomposed into a security posture (tactical level) and a local recovery status (operational level), as detailed below. System states. Consider an IT infrastructure with N components. Each com- ponent can be in two global states: safe (0) or compromised (1). Consequently, the global security state is the Boolean vector: g t = (g 1 t ,...,g N t ),g k t ∈ 0, 1. Moreover, each component k is associated with a local recovery state, which is defined as the 6-dimensional Boolean vector ℓ k t = (ℓ k(c) t ,ℓ k(a) t ,ℓ k(p) t ,ℓ k(e) t ,ℓ k(h) t ,ℓ k(r) t ),ℓ k t ∈0, 1 6 , where the lth entry indicates whether the lth response stage in Section 3 has been completed. For example, ℓ k(c) t = 1 if the attack has been contained; ℓ k(c) t = 0 otherwise. Hence, the system state s t is obtained by concatenating the global and local states, i.e., s t = ((g k t ,ℓ k t ) k∈[N] ), where [N]≜1, 2,...,N. Beliefs. As discussed in Section 3, the state is unobservable to the defender who needs to form a belief of the state using partial observations o 0:t . Mathematically, a belief is a probability distribution over possible states. Due to the binary struc- ture of s t , the probabilistic belief admits the representation b t = (b g t , (b k t ) k∈[N] ), where b g t ∈ [0, 1] N and b g t (k) indicates the probability of the k-th component Agentic Incident Response Multiscale Planning7 being safe. Similarly, b k(i) t indicates the probability that the i-th response stage has been completed for component k. One important assumption we impose is that each server’s state is independent of the rest, and hence, b g t is a product of Bernoulli distributions. This assumption greatly simplifies the belief space. Actions. Since tactical and operational planning are distinct, we model a re- sponse action as a tuple a t = (a g t ,a ℓ t ), where a g t is the action on the tactical level and a ℓ t is the action at the operational level. Specifically, the tactical ac- tion a g t is a permutation of 1, 2,...,N indicating the response priority over the networked components, where a g t (k) is the priority of system component k. Similarly, the operational action a ℓ t corresponds to the recovery action (e.g., a system command) applied to the prioritized system component. Costs. Given these definitions of the security state s t and response action a t , we define the cost function as c(s t ,a t ) = c g (g t ,a g t ) + c ℓ (ℓ t ,a ℓ t ), where c ℓ models the time required to execute the selected recovery action on the chosen component and c g captures the cost of delaying recovery for the remaining components. This delay matters because unattended compromised components may vary in criticality and importance. To model this importance, we define r(g t ) ∈ R N to be a vector of importance weights, where r k (g t ) is the importance of component k in global state g t and P k∈[N] r k (g t ) = 1. Given these importance weights, we define c g (g t ,a g t ) = λ P j̸=k r j (g t )a g t (j) c ℓ (ℓ t ,a ℓ t ), where k is the component selected for recovery. Thus, the global cost penalizes recovery orders that leave important or risky components waiting. The parameter λ ∈ (0, 1] controls the relative weight of the delay cost compared with the execution time cost. We illustrate this cost definition through the following example. Compromised SafeRecovered Top priority Step t: before recovering central server v 1 v 2 v 3 v 4 v 5 v 6 v 7 0.80.7 0.40.30.70.6 Priority order: a g t (v 1 )=1, a g t (v 2 )=2, a g t (v 3 )=3 Step t+1: after recovering central server v 1 v 2 v 3 v 4 v 5 v 6 v 7 0.8 0.7 0.40.3 0.7 0.6 Updated priority: a g t+1 (v 3 )=1, a g t+1 (v 2 )=2 Fig. 2: Representation of the global state g t and the priority weights r(g t ) as an attack graph; cf. Example 1. Nodes represent system components i∈1,...,N, which are colored green if g i t = 0 and red otherwise. Edges represent attack steps with the associated probabilities. The top priority node is indicated in orange. The left and right graphs represent the priorities at time t and t+1, respectively. 8Gao, Y., Li, T., and Hammar, K. Example 1. The global state g t and the priority weights r(g t ) can be illustrated using an attack graph, where nodes represent system components, directed edges represent attack steps, and edge weights represent probabilities of attack steps; see Fig. 2. As shown in the left graph of Fig. 2, system component v 1 receives the highest priority at step t because it connects two compromised regions of the network. Recovering v 1 can therefore reduce the risk of further attack prop- agation. After component v 1 is recovered, the priorities among the remaining unrecovered components change, which results in a new attack graph with a different structure, as shown in the right graph of Fig. 2. State dynamics. State transitions are coupled across the global and local scales. In particular, the local recovery action a ℓ t updates the local state ℓ k t according to a g t , which determines whether the global state of that component (i.e., g k t ) is updated or not. This coupling gives the factorized transition model P θ (s t+1 | s t ,a t ) = P g θ (g t+1 | g t ,a g t )P k θ (ℓ k t+1 | ℓ k t ,a ℓ t ), a g t (k) = 1, where k denotes the component selected for recovery and P k θ models the progress of component k through the response stages under action a ℓ t . The global state transition follows from the outcome of the local action. Specifically, if component k is compromised and its local state reaches the recovered state ℓ k T = (1, 1, 1, 1, 1, 1), then its global state becomes safe (g k t+1 = 0). Otherwise, it remains compromised (g k t+1 = 1), as formally expressed below. P g θ (g k t+1 = 0| g k t = 1) = 1ℓ k t+1 = ℓ k T ,P g θ (g k t+1 = 1| g k t = 1) = 1ℓ k t+1 ̸= ℓ k T . For all other components, the global state transition is governed by the at- tack graph, which models how the attack spreads from the compromised nodes. Specifically, let g −k t denote the global state of all components except k, i.e., g t+1 = (g k t+1 ,g −k t+1 ). Then, P g θ (g t+1 | g t ,a g t ) = P g θ (g k t+1 | g k t )P g θ (g −k t+1 | g −k t ). These definitions imply that the global and local transition kernels differ in both timescale and granularity. In particular, the global state g k t changes only after component k has completed several recovery steps and reached its terminal recovery state. Thus, global transitions describe network-level changes in com- promise status, while local transitions capture the detailed recovery progress of an individual component, which motivates our multiscale planning approach. 5 Agentic Multiscale Response Planning In this section, we present our method for incident response planning. It includes an offline stage and an online stage. In the offline stage, we fine-tune a lightweight LLM using incident response examples. In the online stage, we use the fine-tuned LLM and a digital twin to plan responses at two scales: tactical and operational. At the tactical scale, a decision-theoretic planner uses digital twin simulation to prioritize which component to recover next. At the operational scale, an LLM- based agent generates recovery actions for that component and verifies them through digital twin emulation. Agentic Incident Response Multiscale Planning9 5.1 Offline Fine-tuning of a Lightweight LLM We adapt the DeepSeek-R1-14B [17] LLM to incident response by fine-tuning it on a labeled dataset of incident descriptions. We fine-tune three variants of the model, each corresponding to a different stage of the response workflow. Incident assessment fine-tuning. We start by fine-tuning the LLM to infer likely attacker tactics and techniques from an incident description, such as sys- tem logs and security alerts. We conduct this fine-tuning by training the LLM on a labeled dataset of incident examples, denoted by D incident = (x i , y i ) K i=1 . Each input x i contains an incident description (e.g., security alerts), while the target output y i contains the corresponding MITRE ATT&CK tactics and tech- niques [48]. Tokenizing each label as y i = (y i 1 ,...,y i l ), we fine-tune the model by sampling mini-batches and minimizing the standard autoregressive cross-entropy loss, where Φ w denotes the LLM with tunable model weights w ∈ R d . L(w) =− 1 B B X i=1 l i X k=1 logΦ w (y i k |x i ,y i 1:k−1 ).(1) Belief generation fine-tuning. Next, we apply the same fine-tuning method to adapt a version of the LLM for belief estimation. Specifically, given incident observations and previous actions, the model is trained to estimate the belief b t and an evidence summary m t , which contains the observations that support b t . The training data consists of instruction-answer pairs where the input describes the incident context and the output provides the corresponding belief b t and evidence summary m t . This fine-tuning enables the agent to compress incident context (e.g., logs and alerts) into a compact belief representation (b t ,m t ). Response action fine-tuning. Lastly, we apply the same fine-tuning method to adapt a version of the LLM to generate response actions conditioned on the current belief state. In this case, each training example provides the incident description, the current belief (b t ,m t ), and the previous response action a t−1 as input. The model is then trained to predict the next local action a ℓ t , which can be verified in the digital twin, as detailed below. 5.2 Digital Twin for Simulation and Emulation The digital twin is an isolated execution environment that replicates the rele- vant hosts, services, and configurations of the system affected by the incident, as shown in Fig. 3. It provides a safe environment to investigate the incident and evaluate response actions. For example, if the incident occurs in a cloud environment, then the digital twin can be created by taking snapshots of system components and deploying them in a private cloud. Without such a digital twin, investigation and testing must be performed directly on the affected system, which increases risks and operational costs. In our method, the digital twin supports two complementary modes of exe- cution: simulation and emulation. In simulation mode, it uses a network attack 10Gao, Y., Li, T., and Hammar, K. DIGITAL TWIN ... Virtual network Virtual devices Emulated services Emulated actors AFFECTED SYSTEM Selective replication Client network 10.0.1.0/24 Server network 10.0.2.0/24 Client 10.0.1.11 Gateway Snort IDS + Router eth0 10.0.1.10 eth1 10.0.2.10 SSH 10.0.2.11 Weak credentials Samba 10.0.2.12 SambaCry, CVE-2017-7494 Shellshock 10.0.2.13 CVE-2014-6271 Web 1 (Nginx) 10.0.2.14 Web-accessible upload Web 2 (Nginx) 10.0.2.15 Diagnostic command injection Fig. 3: (Left) The digital twin is a virtual replica of the affected system, which offers a safe environment for investigating the incident and testing response actions. (Right) The network digital twin configuration adopted in our testbed. graph to evaluate attack progression and compare recovery-priority orders ef- ficiently. This mode is used for tactical planning, where the goal is to decide which component to recover next. In emulation mode, the digital twin executes candidate recovery actions in a replica of the affected environment. This mode is used for operational planning, where the goal is to test whether generated response actions are effective before applying them to the operational system. Identification of an attack graph for simulation. Before initiating tactical response planning, we use the digital twin and the previously fine-tuned LLM to identify an attack graph for simulation. To this end, we prompt the LLM with the incident description I and use it to generate an initial assessment of the likely attack tactics and techniques. We refer to this estimate as an attack conjecture. To improve the robustness of this conjecture, we run M = 10 independent gener- ations and retain only tactics and techniques with empirical frequency exceeding 0.5. We denote the resulting conjecture by ˆ θ ← Φ w (·| I). We then use the digital twin to extract dependencies among system compo- nents, thereby defining a dependency graph G. For each edge i → j ∈ G, we repeatedly test the attack techniques in ˆ θ that could enable this attack step. Subsequently, we use the outcomes of these tests to estimate the probability of the attack step i→ j, and denote the resulting attack graph by G( ˆ θ). 5.3 Tactical and Operational Scale Planning Tactical Planning. The attack graphG( ˆ θ) induces a transition model ˆ P g (g t+1 | g t ,a g t ) of the global state, which we use for tactical scale planning to decide which system component should be recovered next. This tactical planning involves comparing candidate recovery orders through lookahead simulations based on the attack graph and then selecting the order that leads to the minimal cost, which we compute as ˆc g (g t ,a g t )≈ λ P j̸=k r j (g t )a g t (j) τ avg , where k is the component placed first in the recovery order and τ avg is the average local execution time of previously attended nodes. We use the average time since the exact recovery time is not known before selecting a component. Agentic Incident Response Multiscale Planning11 To evaluate candidate recovery orders, we first use the fine-tuned LLM to generate a belief state b t . We then use this belief state to sample M g possible global states as ˆg i t i∈[M g ] ∼ b g t and simulate H g lookahead steps in the at- tack graph. We then estimate the cost of the resulting rollout by averaging the sampled states as J(ˆa g ) = 1 M g P i∈[M g ] P H g k=0 ˆc g (ˆg i t+k , ˆa g ), where ˆg i t+k ∼ ˆ P g (· | ˆg i t+k−1 , ˆa g ). Next, we select the recovery order with the lowest estimated cost: a g t = arg min ˆa∈A g t J(ˆa). Since enumerating all N! recovery orders is computa- tionally infeasible for large systems, we restrict this minimization to candidate orders derived by permuting the previous order a g t−1 . Operational Planning. Given the belief and system components selected by tactical planning, operational planning decides how to recover those components, i.e., it determines the next local recovery action a ℓ t . This planning process in- volves three main steps. First, we use the fine-tuned LLM to generate a set of candidate response actions A ℓ t = ˆa 1 t , ˆa 2 t ,..., ˆa N ℓ t . Second, we evaluate the candidate actions using LLM-generated recovery rollouts. In particular, for each candidate action ˆa i t , we use the fine-tuned LLM to generate M ℓ > 0 recovery trajectories. Each trajectory starts with an action ˆa i t and continues until the tar- get component reaches the recovered state ℓ T = (1, 1, 1, 1, 1, 1). These rollouts are then used to estimate the remaining recovery cost as Q(b t , ˆa i t ) = 1 M ℓ X j∈[M ℓ ] X ˆa∈q i,j c(ˆa),c(ˆa) = ( DT-Emul(ˆa), if verified by DT, ∞,otherwise, where q i,j is the jth rollout trajectory starting from action ˆa i t , and the time cost of each action is estimated by execution time in the digital twin, denoted by DT-Emul(ˆa). If the action is not executable, the cost is set to ∞. The third step selects the action with the lowest estimated cost. We then execute the selected action in the digital twin. As a result of this execution, the digital twin produces a new observation o t+1 (e.g., the outcome of the action), which we feed to the fine-tuned LLM to generate a new belief (b t+1 ,m t+1 ). We then repeat the same planning procedure from the new belief. This process of planning a local recovery action, executing it, and updating the belief continues until the component is recovered 6 Experiment In this section, we present an experimental evaluation of our method for agentic response planning. We start by assessing the effectiveness of offline fine-tuning. We then compare the recovery-action execution time and recovery rate of our method with frontier LLMs and two state-of-the-art baselines: ircopilot [37] and llm-ir [19]. 6.1 Experiment Setup We instantiate the LLM Φ w [cf. (1)] with DeepSeek-R1-Distill-Qwen-1 4B and fine-tune its weights using LoRA. The base-model parameters remain 12Gao, Y., Li, T., and Hammar, K. frozen during fine-tuning, while the trainable parameters are restricted to the LoRA adapter weights. The hyperparameters used for fine-tuning are available in Appendix A. The prompt templates and related artifacts are available online 3 . Fine-tuning datasets. We use the training dataset from [19] to fine-tune the LLM. This dataset is divided into three separate fine-tuning datasets: D = D incident ∪D state ∪D action to fine-tune three versions of the LLM. First, we useD incident for incident-assessment fine-tuning, where each training example consists of a system description and security logs. The model is fine- tuned to decide whether the evidence in the logs indicates an incident, summarize the incident, identify involved entities, and assign MITRE ATT&CK tactics. Second, we use D state for belief-generation fine-tuning, where each training example includes the system description, logs, incident summary, local state, and previously executed response actions. The model is trained to predict the next global and local recovery state, along with a summary of evidence. The belief is obtained by the empirical distribution of repeatedly generated state predictions. Third, we use D action , for action-generation fine-tuning, where each training example instructs the model to generate the next response action based on the local state and previous actions. Digital twin. We use a dockerized digital twin that emulates a small segmented enterprise network with two subnets: a client network 10.0.1.0/24 and a server network 10.0.2.0/24; see Fig. 3. The two subnets are connected by a gateway container, which acts as both the network router and the IDS monitoring point. The gateway has IP address 10.0.1.10 on the client network and 10.0.2.10 on the server network. It runs Snort to collect alerts and uses iptables to support containment and recovery actions. The client container has IP address 10.0.1 .11 and serves as the attack platform in the experiments. It includes common network and exploitation tools, including nmap, hydra, curl, smbclient, and sshpass. The roles of the components are summarized in Table 7 in Appendix A. Attack scenarios. We consider three different attack scenarios to evaluate our method. These scenarios, which we refer to as Weak-Credential-3, Shellshock- 4, and Command-Injection-5, are designed to exhibit different combinations of attack patterns (e.g., command injection) that compromise different nodes in the digital twin. We defer the detailed setup to Appendix A. 6.2 LLM Generation Evaluation In this section, we present an evaluation of the generation capabilities of the fine-tuned LLMs. For each fine-tuned LLM, we evaluate the LLM on a set of testing incident examples reported in the literature, listed in Table 1. Incident assessment evaluation. We begin by evaluating the fine-tuned LLM’s ability to identify MITRE ATT&CK tactics from incident descriptions and security logs. For each ground-truth tactic in the test data, we define preci- sion as the fraction of predicted instances that correctly include the tactic among 3 GitHub repository:https://github.com/TaoLi-NYU/Agentic-Incident-Respons e-ESORICS26 Agentic Incident Response Multiscale Planning13 DatasetSystemsAttackslogs CTU-Malware-2014 [14] windows xp sp2 Malwares and ransomwaressnort alerts CIC-IDS-2017 [47]windows, linux Denial-of-Service, web attacks, sql injections, and etc. snort alerts AIT-IDS-V2-2022 [27] windows, linux Multi-stage attacks from reconnaissance to escalation wazuh alerts CSLE-IDS-2024 [22] linuxSoftware exploits, e.g., cve-2015-1427snort alerts Table 1: The four evaluation datasets used to evaluate the fine-tuned LLMs. all predictions, and recall as the fraction of testing instances that contain the tactic and are correctly predicted. Table 2 summarizes the results. We observe that the prediction accuracy is positively correlated with the occurrences of each tactic in the training dataset. Moreover, we find that the model achieves high precision and recall (≥ 0.85) for the most common tactics (e.g., reconnaissance), but lower accuracy for the less common tactics (e.g., discovery). TacticPrecision Recall F1 Reconnaissance1.000 0.857 0.923 Initial Access0.839 0.975 0.902 Execution0.938 0.974 0.955 Persistence0.500 0.667 0.571 Privilege Escalation0.378 0.583 0.459 Defense Evasion0.417 0.714 0.526 Credential Access0.733 0.647 0.688 Discovery0.333 0.765 0.464 Lateral Movement0.527 0.879 0.659 Collection0.571 0.800 0.667 Command and Control 0.690 0.925 0.790 Exfiltration0.833 0.893 0.862 Impact0.818 0.818 0.818 Table 2: Evaluation of the LLM for incident assessment. caa-F1 csa-F1 ℓ c ℓ a ℓ p ℓ e ℓ h ℓ r F1 0.9902 0.9822 0.9975 0.9964 0.9970 0.9952 0.9541 0.9533 Table 3: Evaluation of the LLM for belief gen- eration; reproduced from Tab. 2 [13]. ScenarioGround truthPredicted beliefBCE Weak-Credential-3(0, 0, 0, 1, 1) (0.04, 0.06, 0.08, 0.58, 0.58) 0.2551 Shellshock-4(0, 0, 0, 0, 1) (0.04, 0.08, 0.04, 0.10, 0.92) 0.0708 Command-Injection-5 (0, 0, 0, 0, 0) (0.10, 0.12, 0.10, 0.26, 0.10) 0.1490 Table 4: Evaluation of the LLM for belief gen- eration. Belief generation evaluation. Since each local recovery state is a six-dim Boolean vector (see Section 3), predicting the local state is a multi-label binary classification problem. For this reason, we evaluate the LLM’s predictions using the F1 score. In addition to the F1 score, we also measure two averaged F1 scores: (i) class-agnostic average F1 (caa-F1), which aggregates True Positive (TP)/ False Positive (FP)/ False Negative (FN) across all entries before computing F1; and (i) class-specific average F1 (csa-F1), which computes F1 per Boolean entry and then averages across entries. The F1 scores are summarized in Table 3. We find that our lightweight LLM can accurately predict the recovery state. In addition to the evaluation in terms of the F1 score of the state prediction, we consider the LLM-generated global state beliefs specific to the three attack scenarios in the digital twin. Specifically, Table 4 lists the binary cross-entropy between the generated belief and the true state. We observe in the table that the generated beliefs put most probability mass on the true state. Response action generation evaluation. We then evaluate the response actions generated by the fine-tuned LLM for the five most frequent MITRE ATT&CK tactics in the testing dataset. For each tactic, we randomly select 30 incident examples and prompt the model to generate actions, whose effectiveness 14Gao, Y., Li, T., and Hammar, K. is judged by codex, a gpt-powered coding agent with access to the ground-truth actions. A generated action is said to pass the test if it advances the recovery progress to the same extent as the ground-truth action. Table 5 summarizes the pass rate across the 150 testing examples, indicating that our model can generate effective actions for different tactics. MITRE ATT&CK tactics# PassFail Initial Access, Execution, Collection, Exfiltration30 24 (80.0%) 6 (20.0%) Initial Access, Execution, Command and Control, Exfiltration 30 23 (76.7%) 7 (23.3%) Initial Access, Execution, Credential Access, Exfiltration30 28 (93.3%) 2 (6.7%) Impact30 25 (83.3%) 5 (16.7%) Initial Access, Execution, Command and Control30 28 (93.3%) 2 (6.7%) Overall150 128 (85.3%) 22 (14.7%) Table 5: Evaluation of the LLM for action generation. 6.3 Recovery-Action Execution-Time Evaluation In this section, we evaluate the execution performance of our agentic method using response action execution time (s) and recovery rate (%). Execution time excludes planning, LLM inference, and DT-verification. We consider two eval- uation metrics: the recovery time (s) and the recovery rate (%). The former measures the average time to recover the system from an incident using the planned sequence, and the latter measures the percentage of fully recovered in- cidents among those evaluated. We highlight that the recovery time excludes the planning time, LLM inference time, and DT verification time. All evaluations are performed using the digital twin shown in Fig. 3 and the incidents (attack scenarios) described in Appendix A. Baselines. We use six baselines. The first four baselines are the current frontier LLMs, namely: gpt-5.5 [44], gemini-3.1-pro [7], deepseek-v4-pro [8], and claude-opus-4.8 (high effort) [3]. Compared with these LLMs, our method is significantly more lightweight and fine-tuned towards the incident response use cases. In addition to the frontier LLMs, we compare the performance of our method with that of ircopilot [37] and llm-ir [19], both of which are agentic response methods proposed in the literature. Compared with our agent, ircopilot uses our fine-tuned model only for operational planning, and llm-ir uses LLM-based rollout at the operational scale without digital twin verification. The two baselines constitute ablations of the usage of rollout and digital twin. Evaluation scenarios. We consider two evaluation scenarios. In the first sce- nario, we use the tactical-scale plan produced by our method to evaluate all baselines. Hence, this evaluation scenario compares the operational-scale plan- ning capabilities of the different methods. In the second scenario, we measure the benefit of the tactical planning component of our method by prompting each baseline method to perform tactical-scale planning as well. Evaluation results. The results for evaluation scenario 1 are summarized in Figs. 4a, 4b, and 4c. Bar colors represent different methods; numbers and error bars indicate the mean and standard deviation from 50 independent runs using Agentic Incident Response Multiscale Planning15 distinct random seeds. Notably, the recovery rates of our method, which are around 90% in three attack scenarios, surpass all other baselines by a large margin. In contrast, the frontier models only achieve rates below 75%, and the rates for two LLM-based approaches are between 50% and 65%. Moreover, our method achieves the shortest average recovery time, outperforming the frontier models by 15.1%. We attribute this result to the fine-tuning. The evaluation results related to scenario 2 are summarized in Fig. 4d. Similar to the results for scenario 1, we see that our method maintains a recovery rate of around 90% on average, which is above 30% higher than the two baselines. The average recovery time of our method is 57.8% and 53.9% less than those of llm-ir and ircopilot, respectively. These results highlight the benefit of tactical planning. 0 50 100 150 44 . 47 49 . 79 52 . 94 60 . 11 50 . 89 76 . 73 118 . 87 Recovery time (s) 0 50 100 94 . 4 % 68 . 2 % 57 . 1 % 53 . 2 % 71 . 4 % 56 . 3 % 58 % Recovery rate (%) our agent gpt-5.5gemini-3.1-pro-previewdeepseek-v4-pro claude-opus-4.8 llm-irircopilot (a) Evaluation scenario 1, attack scenario Weak-Credential-3. 0 50 100 59 . 79 60 . 49 66 . 52 67 . 28 60 . 86 89 . 91 71 . 46 Recovery time (s) 0 50 100 92 . 6 % 64 . 9 % 52 . 3 % 49 . 8 % 67 . 3 % 54 . 3 % 62 . 5 % Recovery rate (%) our agent gpt-5.5gemini-3.1-pro-previewdeepseek-v4-pro claude-opus-4.8 llm-irircopilot (b) Evaluation scenario 1, attack scenario Shellshock-4. 0 50 100 150 75 . 18 87 . 39 100 . 36 113 . 52 86 . 51 124 . 94 111 . 48 Recovery time (s) 0 50 100 89 . 7 % 61 % 47 . 3 % 46 . 8 % 64 . 2 % 47 . 9 % 64 . 7 % Recovery rate (%) our agent gpt-5.5gemini-3.1-pro-previewdeepseek-v4-pro claude-opus-4.8 llm-irircopilot (c) Evaluation scenario 1, attack scenario Command-Injection-5. Weak-Credential-3Shellshock-4Command-Injection-5 0 100 200 44 . 5 59 . 8 75 . 2 115 . 5 120 . 1 150 . 7 116 133 . 3 173 . 6 Recovery time (s) 0 50 100 94 . 4 % 92 . 6 % 89 . 7 % 58 . 3 % 54 . 8 % 51 . 4 % 48 . 2 % 45 . 8 % 42 . 5 % Recovery rate (%) our agentircopilotllm-ir (d) Evaluation scenario 2, across three at- tack scenarios. Fig. 4: Evaluation of recovery-action execution time and rate in the end-to-end incident response. The bars relate to the recovery time (↓ better) and the recov- ery rate (↑ better). 16Gao, Y., Li, T., and Hammar, K. 6.4 Discussion The experimental results demonstrate that our method for agentic multiscale response planning consistently outperforms the frontier LLMs and prior works on LLM-based incident response across three attack scenarios. The compar- isons with frontier LLMs suggest that a tailored, lightweight model powered by decision-theoretic planning provides a sufficient agentic approach for inci- dent response. We attribute this result to the digital twin-based verification, which leads to higher recovery rates in our evaluation. Moreover, compared with prior LLM-based incident response approaches, the tactical-scale planning in our method improves performance by strategically selecting the recovery order. Limitations. One limitation of our method is the misspecification of attack tactics during incident assessment. If the inferred attack conjecture deviates from the true tactics, the attack graph becomes inaccurate, and tactical-scale planning becomes less effective. While prior work has begun to address misspecification in security settings [21,20], this challenge remains unexplored when an LLM (i.e., a black-box generative model) serves as the inference model. Another limitation of our method is the cost of LLM-based rollout in operational planning. Failed verification adds extra cost due to regeneration and digital twin reinitialization. This can be partially mitigated through parallel LLM sessions and digital twin emulations. Connections to response playbooks. Our agentic response planning method serves a similar role to incident response playbooks [4], but focuses on generating executable operational actions. Compared with conventional playbooks, it offers two advantages. First, it produces concrete and context-specific actions tailored to the system of interest. Second, it acts as a dynamic playbook by prioritizing compromised nodes through multiscale planning. 7 Conclusion We present an agentic approach that integrates decision-theoretic planning, large language models (LLMs), and digital twins for incident response planning. The proposed method uses a rollout planner based on digital twin simulation to com- pute a high-level response strategy that allocates security resources at the tacti- cal scale. A lightweight LLM, fine-tuned over public incident datasets, translates the abstract strategies into executable commands verified by the digital twin emulation at the operational scale. We evaluate the agentic response planning approach on logs reported in the literature and three distinct attack scenarios on a testbed. Across three scenarios, our agentic approach maintains a recovery rate of around 90%, reduces recovery-action execution time by 15.1% on average, and increases the recovery rate by 33.6% over the frontier LLMs. A primary direction for future work is to address the attack tactics misspeci- fication in the LLM-based incident assessment, which plays an instrumental role in tactical planning. The key is to leverage LLMs’ in-context learning ability to calibrate their inference about potential tactics in the network by comparing observed alerts with predicted alerts under misspecified tactics. Agentic Incident Response Multiscale Planning17 References 1. Allison, D., Smith, P., McLaughlin, K.: Digital twin-enhanced methodology for training edge-based models for cyber security applications. In: 2022 IEEE 20th International Conference on Industrial Informatics (INDIN). p. 226–232 (2022) 2. Alpcan, T., Başar, T.: Network Security: A Decision and Game-Theoretic Ap- proach. Cambridge University Press, USA, 1st edn. (2010) 3. Anthropic: System card: Claude opus 4.8 (2026), [Online] Available at https: //w.anthropic.com/news/claude-opus-4-8 4. Applebaum, A., Johnson, S., Limiero, M., Smith, M.: Playbook oriented cyber response. In: 2018 National Cyber Summit (NCS). p. 8–15 (2018) 5. Bertsekas, D.P.: Model predictive control and reinforcement learning: A unified framework based on dynamic programming. IFAC-PapersOnLine 58(18), 363–383 (2024) 6. Castro, S.R., Campbell, R., Lau, N., Villalobos, O., Duan, J., Cardenas, A.A.: Large language models are autonomous cyber defenders. In: IEEE Conference on Artificial Intelligence Workshop on Adaptive Cyber Defense (2025) 7. DeepMind, G.: Gemini 3.1 pro: Model card (2026), [Online] Available at https: //storage.googleapis.com/deepmind-media/Model-Cards/Gemini-3-1-Pro-M odel-Card.pdf 8. DeepSeek-AI: DeepSeek-V4: Towards highly efficient million-token context intelli- gence (2026), [Online] Available at https://arxiv.org/pdf/2606.19348 9. Dietz, M., Englbrecht, L., Pernul, G.: Enhancing industrial control system forensics using replication-based digital twins. In: Peterson, G., Shenoi, S. (eds.) Advances in Digital Forensics XVII. p. 21–38. Springer International Publishing, Cham (2021) 10. Dietz, M., Pernul, G.: Unleashing the digital twin’s potential for ICS security. IEEE Security & Privacy 18(4), 20–27 (2020) 11. Dietz, M., Vielberth, M., Pernul, G.: Integrating digital twin security simulations in the security operations center. Proceedings of the 15th International Conference on Availability, Reliability and Security p. 1–9 (2020) 12. Eckhart, M., Ekelhart, A., Weippl, E.: Enhancing cyber situational awareness for cyber-physical systems through digital twins. In: 24th IEEE International Con- ference on Emerging Technologies and Factory Automation (ETFA). vol. 1, p. 1222–1225 (2019) 13. Gao, Y., Hammar, K., Li, T.: In-context autonomous network incident response: An end-to-end large language model agent approach. In: Proceedings of the 2026 AAAI Summer Symposium Series. vol. 9 (2026) 14. García, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Computers & Security 45, 100–123 (2014) 15. Ge, Y., Li, T., Zhu, Q.: Scenario-agnostic zero-trust defense with explainable threshold policy: A meta-learning approach. In: IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE INFOCOM, vol. 00, p. 1–6 (2023) 16. Grieves, M., Vickers, J.: Digital twin: Mitigating unpredictable, undesirable emer- gent behavior in complex systems. In: Transdisciplinary perspectives on complex systems: New findings and approaches, p. 85–113. Springer (2016) 17. Guo, D., et al.: DeepSeek-r1 incentivizes reasoning in LLMs through reinforcement learning. Nature 645(8081), 633–638 (2025) 18. Hammar, K.: CSLE: A reinforcement learning platform for autonomous security management. In: Ninth Conference on Machine Learning and Systems (2026) 18Gao, Y., Li, T., and Hammar, K. 19. Hammar, K., Alpcan, T., Lupu, E.C.: Incident response planning using a lightweight large language model with reduced hallucination. In: Network and Dis- tributed System Security (NDSS) Symposium 2026 (2026) 20. Hammar, K., Li, T.: Online incident response planning under model misspecifica- tion through bayesian learning and belief quantization. In: Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security. p. 40–51. AISec (2025) 21. Hammar, K., Li, T., Stadler, R., Zhu, Q.: Adaptive security response strategies through conjectural online learning. IEEE Transactions on Information Forensics and Security 20, 4055–4070 (2025) 22. Hammar, K., Stadler, R.: The csle-ids-2024 dataset (2024), [Online] Avaiable at https://doi.org/10.5281/zenodo.10706475 23. Iannucci, S., Abdelwahed, S., Montemaggio, A., Hannis, M., Leonard, L., King, J.S., Hamilton, J.A.: A model-integrated approach to designing self-protecting sys- tems. IEEE Transactions on Software Engineering 46(12), 1380–1392 (2018) 24. IBM Security: Cost of a data breach report 2025. Tech. rep., IBM and Ponemon Institute (2025) 25. Kaloroumakis, P.E., Smith, M.J.: Toward a knowledge graph of cybersecurity coun- termeasures. Tech. rep., The MITRE Corporation (2021) 26. Kreidl, O., Frazier, T.: Feedback control applied to survivability: a host-based autonomic defense system. IEEE Transactions on Reliability 53(1), 148–166 (2004) 27. Landauer, M., Skopik, F., Wurzenberger, M.: Introducing a new alert data set for multi-step attack analysis. In: Proceedings of the 17th Cyber Security Experimen- tation and Test Workshop. p. 41–53 (2024) 28. Li, T., Bian, Z., Lei, H., Zuo, F., Yang, Y.T., Zhu, Q., Li, Z., Chen, Z., Ozbay, K.: Digital twin-based driver risk-aware predictive mobility analytics for real-time sit- uational awareness through cooperative sensing. IEEE Transactions on Intelligent Transportation Systems 26(11), 20071–20090 (2025) 29. Li, T., Hammar, K., Stadler, R., Zhu, Q.: Conjectural online learning with first- order beliefs in asymmetric information stochastic games. In: 2024 IEEE 63rd Conference on Decision and Control (CDC). p. 6780–6785 (2024) 30. Li, T., Lei, H., Guo, H., Yin, M., Hu, Y., Zhu, Q., Rangan, S.: Digital twin-enhanced wireless indoor navigation: Achieving efficient environment sensing with zero-shot reinforcement learning. IEEE Open Journal of the Communications Society 6, 2356–2372 (2025) 31. Li, T., Lei, H., Zhu, Q.: Self-adaptive driving in nonstationary environments through conjectural online lookahead adaptation. In: 2023 IEEE International Con- ference on Robotics and Automation (ICRA). p. 7205–7211 (2023) 32. Li, T., Pan, Y., Zhu, Q.: Decision-dominant strategic defense against lateral move- ment for 5g zero-trust multi-domain networks. In: Chen, Y., Wu, J., Yu, P., Wang, X. (eds.) Network Security Empowered by Artificial Intelligence, p. 25–76. Springer Nature Switzerland, Cham (2024) 33. Li, T., Peng, G., Zhu, Q., Başar, T.: The confluence of networks, games, and learning a game-theoretic framework for multiagent decision making over networks. IEEE Control Systems 42(4), 35–67 (2022) 34. Li, T., Zhao, Y., Zhu, Q.: The role of information structures in game-theoretic multi-agent learning. Annual Reviews in Control 53, 296–314 (2022) 35. Li, T., Zhu, Q.: Agentic AI for cyber resilience: A new security paradigm and its system-theoretic foundations. arXiv preprint arXiv:2512.22883 (2025) 36. Li, T., Zhu, Q.: Symbiotic game and foundation models for cyber deception oper- ations in strategic cyber warfare. In: Foundations of Cyber Deception, p. 25–62. Springer Cham (2025) Agentic Incident Response Multiscale Planning19 37. Lin, X., Zhang, J., Deng, G., Liu, T., Zhang, T., Chen, R., Guo, Q.: IRCOPILOT: Automated incident response with large language models. arXiv:2505.20945 (2025) 38. Loevenich, J.F., Adler, E., Mercier, R., Velazquez, A., Lopes, R.R.F.: Design of an autonomous cyber defence agent using hybrid AI models. In: 2024 Interna- tional Conference on Military Communication and Information Systems (ICMCIS). vol. 00, p. 1–10 (2024) 39. Manshaei, M.H., Zhu, Q., Alpcan, T., Başar, T., Hubaux, J.P.: Game theory meets network security and privacy. ACM Comput. Surv. 45(3) (Jul 2013) 40. Miehling, E., Rasouli, M., Teneketzis, D.: A POMDP approach to the dynamic defense of large-scale cyber networks. IEEE Transactions on Information Forensics and Security 13(10), 2490–2505 (2018) 41. Miehling, E., Rasouli, M., Teneketzis, D.: Control-Theoretic Approaches to Cyber- Security, p. 12–28 (2022) 42. Mohammadi, H., Davis, J.J., Kiely, M., Mohammadi, H.: Leveraging large language models for autonomous cyber defense: Insights from CAGE-2 simulations. IEEE Intelligent Systems 40(4), 29–36 (2025) 43. Nguyen, T.T., Reddi, V.J.: Deep reinforcement learning for cyber security. IEEE Transactions on Neural Networks and Learning Systems 34(8), 3779–3795 (2023) 44. OpenAI: GPT-5.5 system card (2026), [Online] Available at https://deployment safety.openai.com/gpt-5-5/gpt-5-5.pdf 45. Pokhrel, A., Katta, V., Colomo-Palacios, R.: Digital twin for cybersecurity incident prediction: A multivocal literature review. In: Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops. p. 671–678 (2020) 46. Repetto, M.: Cybersecurity digital twins: Concept, blueprint, and challenges for multi-ownership digital service chains. Journal of Information Security and Appli- cations 96, 104299 (2026) 47. Sharafaldin, I., Habibi Lashkari, A., Ghorbani, A.A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: Proceedings of the 4th International Conference on Information Systems Security and Privacy - ICISSP. p. 108–116 (2018) 48. Strom, B.E., Applebaum, A., Miller, D.P., Nickels, K.C., Pennington, A.G., Thomas, C.B.: MITRE ATT&CK: Design and philosophy. Tech. rep., The MITRE Corporation (2018) 49. Vyas, S., Mavroudis, V., Burnap, P.: Towards the deployment of realistic au- tonomous cyber network defence: A systematic review. ACM Computing Surveys 58(1), 1–36 (2025) 50. Wang, Z., Shi, T., He, J., Cai, M., Zhang, J., Song, D.: Cybergym: Evaluating AI agents’ real-world cybersecurity capabilities at scale. In: The Fourteenth Interna- tional Conference on Learning Representations (2026) 51. Wu, X., Farooq, J., Li, T., Chen, J., Wang, Y.: Delay-aware reinforcement learning for o-ran control under stochastic reward feedback. IEEE Networking Letters p. 1– 1 (2026). https://doi.org/10.1109/LNET.2026.3699505 52. Yan, Y., Zhang, Y., Huang, K.: Depending on yourself when you should: Mentoring LLM with RL agents to become the master in cybersecurity games. arXiv (2024) 53. Zhang, J., Bu, H., Wen, H., Liu, Y., Fei, H., Xi, R., Li, L., Yang, Y., Zhu, H., Meng, D.: When LLMs meet cybersecurity: A systematic literature review. Cybersecurity 8(1), 55 (02 2025) 20Gao, Y., Li, T., and Hammar, K. A Experiment Setup Details Offline fine-tuning is performed on a Google Cloud virtual machine with 1 Nvidia A100 GPU, and the LoRA hyperparameters are presented in Table 6. The com- ponents of our digital twin testbed are summarized in Table 7. Parameter(s)Value(s) LoRA rank, scaling, dropout 64, 128, 0.05 Learning rate9.5× 10 −4 Per-device batch size1 Gradient accumulation steps 32 Effective batch size32 Precisionbfloat16 Table 6: A summary of LoRA fine-tuning hyperparameters. HostIP address Service role server_ssh 10.0.2.11 OpenSSH service server_samba 10.0.2.12 Samba file sharing server_shellshock 10.0.2.13 Apache CGI service server_web1 10.0.2.14 Nginx and upload service server_web2 10.0.2.15 Nginx and diagnostic service Table 7: Components of the digital twin. Attack scenarios. The first scenario, which we refer to as Weak-Credential- 3, represents a multi-stage attack launched from the client host 10.0.1.11 that eventually takes down three nodes. The attack starts with network recon- naissance and TCP service scanning across the server network. It then com- promises server_ssh at 10.0.2.11 through weak SSH credentials, accesses server_samba at 10.0.2.12 through an exposed anonymous SMB share, and exploits the Shellshock-vulnerable CGI service on server_shellshock at 10.0.2.13. The attack also probes the two web servers at 10.0.2.14 and 10.0.2.15. Finally, it uses the compromised SSH server as a pivot to reach other internal services. This scenario mainly compromises the first three servers in Table 7. The second scenario, referred to as Shellshock-4, targets four servers: 10 .0.2.11, 10.0.2.12, 10.0.2.13, and 10.0.2.14. Unlike the first scenario, it avoids a broad ICMP sweep and instead performs targeted service discovery. It uses low-volume SSH password spraying against server_ssh, anonymous SMB share access against server_samba, Shellshock exploitation against server_she llshock, and unauthorized HTTP upload against server_web1. The scenario also includes a pivot from server_shellshock, where commands executed on 10.0.2.13 are used to probe reachable services on the other targeted servers. The last scenario extends the attack coverage to all five servers in the server network, which we refer to as Command-Injection-5. This scenario increases attack techniques diversity by using a) service-specific TCP and HTTP finger- printing; b) SSH credential reuse with file transfer; c) multi-file SMB staging and rename operations; d) Shellshock command execution; and e) command injection through the diagnostic service on server_web2. In contrast to the previous sce- narios, the pivot host is server_web2. After command injection, the attack uses this host to probe reachable services on the other servers. This scenario evaluates the framework under a full five-server compromise with a different pivot point and a broader mixture of service-specific attack evidence.