Agentic AI for Cyber Defense: A Survey of Failure Modes, Applications, and Research Opportunities

1. Introduction

Perpetual co-evolution of cyber threats and defenses ensures that no security posture remains sufficient indefinitely. Cyberthreat landscape has undergone a significant transformation in recent years. From highly targeted Advanced Persistent Threats (APTs) [89] to autonomous botnets and ransomware campaigns [88], cyberattacks have become increasingly adaptive, scalable, and context-aware. While symbolic automation through signature-based detection and Machine Learning (ML) classifiers has advanced, defensive workflows remain predominantly reactive and reliant on continuous human decision-making. This burden falls disproportionately on analysts working in Security Operations Centers (SOCs), who must filter through enormous volumes of alerts, logs, and indicators to triage, analyze, and respond in real time. Operational asymmetry is stark: attackers traverse networks under 30 minutes [77], yet SOC teams require a reported mean of 181 days to identify and an additional 60 days to contain a breach [132]. This gap is compounded by alert fatigue, knowledge fragmentation across disconnected tools and memory, and analyst expertise [7].

This imbalance exposes a fundamental limitation of current cybersecurity operations: the absence of adaptive, goal-driven intelligence that can reason across heterogeneous knowledge sources and formulate multi-step response strategies autonomously to assist SOC analysts [86]. Agentic AI, a category of intelligent systems that exhibit autonomy through perception, planning, acting, and self-reflection, has emerged as a promising paradigm for addressing this gap [1]. Unlike narrow AI, modern agentic systems, often powered by LLMs, operate autonomously and are capable of perceiving context, formulating strategies, invoking external tools, and revising behavior based on feedback. These capabilities directly support critical SOC functionality, including alert triage, threat correlation, vulnerability remediation, and response generation [52]. Reflecting this, Gartner’s Predicts 2025 report forecasts that agentic AI will improve SOC efficiency by 40% by 2026 relative to 2024, while concluding that fully autonomous SOC remains unlikely [37].

While this autonomy enables adaptive defense, it simultaneously introduces substantial risks, including hallucinations, adversarial exploitation, and limited explainability [87]. These risks are amplified in the cybersecurity context, especially when agents manage production systems and interact with external sources under little human oversight, thereby considerably expanding the attack surface [64,98]. Reflecting these concerns, a KPMG survey of UK technology leaders found that half of corporate boards identified cybersecurity as a significant barrier to adopting generative or agentic AI [63]. With regular developments, the literature on agentic AI for cybersecurity remains fragmented. Prior work broadly addresses AI in cybersecurity [5,46], focusing predominantly on ML classifiers or generative models [44,126], while treating agentic systems as a peripheral topic rather than a distinct paradigm with unique architectural, operational, and risk characteristics. Recently, researchers have begun to examine agentic AI in cybersecurity [2,65,67,137], and domain-agnostic surveys have advanced threat taxonomies for modern LLM-powered agents [20,42,47,118,130]. However, no existing survey structurally maps agentic AI to the defensive cybersecurity operations lifecycle, classifies failure modes across causal categories, addresses compliance implications, or bridges the gap between academic research and industry practice in a unified manner. To address these gaps, we ask the following Research Questions (RQ):

The rest of this paper is organized as follows: Section 2 describes our survey methodology. Section 3 positions this work relative to existing literature. Section 4 defines agentic AI capabilities and introduces a failure taxonomy and possible mitigation. Section 5 characterizes defensive cybersecurity operations and identifies entry points for agentic automation. Section 6 reviews applied research organized by operational lifecycle tasks. Section 7 reviews commercial offerings based on operational lifecycle tasks with research–practice relations. Section 8 examines the implications of compliance failure. Section 9 identifies challenges and research directions before concluding.

2. Survey Methodology

Given the nascent and rapidly evolving agentic AI landscape, where terminology and reference frameworks remain unstandardized, this survey adopts a structured literature decomposition approach. Our coverage is organized around the major research trajectories shaping the field, with representative works selected from each. Sources include scholarly databases, industry white papers, documentation, and standards-body technical reports. Industry sources are included as significant cybersecurity developments often originate in commercial deployments rather than controlled testbeds. We include brief contextual primers at the beginning of each section to present definitions, reference frameworks, and standards upon their first use, ensuring narrative continuity and avoiding redundancy. Figure 1 presents the survey methodology and section navigation to support reader orientation and illustrate the logical decomposition.

3. Related Studies

This section establishes the foundations for our survey. We first position our research relative to existing literature. Our survey uniquely combines an agentic capabilities, failures, and mitigation taxonomy with the cybersecurity operations lifecycle, an applied framework for agentic integration, an industry review, and compliance analysis. Table 1 compares existing literature across eight relevance dimensions to depict relative positioning in contrast with ours.

The first group comprises surveys on agentic AI in cybersecurity. Lazer et al. [67] provide the broadest treatment, dual-mapping to the Cybersecurity Compass and the NIST Cyber Defense Lifecycle, and analyzing systemic risks including agent collusion and memory poisoning, through the mixed defense, offense, and quantum scope. However, a mix of broader concepts limits its depth of coverage on either side. The remaining entries [2,65,137] each address a single dimension well, capability evolution, industry adoption, or governance, without unifying them under a framework.

The second group, LLM agent security and safety surveys [20,29,42,47,118,130], share a common limitation: an adversarial-only failure lens that excludes natural failures (hallucination, drift, tool error) and system failures (orchestration breakdown, memory corruption, resource exhaustion), both of which dominate real-world deployment incidents. Grimes et al. [42] come closest to our research-practice bridging objective through case-study grounding, but remain domain-agnostic. Surveys addressing model-centric LLM safety, inter-agent communication protocols, or broader AI governance are omitted from the table as they either treat agentic behavior as secondary, are subsumed by entries already included, or fall completely outside the cybersecurity operations spectrum.

The remaining groups serve as boundary markers. Xu et al. [146] establish the offensive counterpart that our defensive scope deliberately excludes, while the non-agentic surveys [44,46,126] document the pre-agentic SOC baseline that planning, tool use, and self-reflection now disrupt. A dedicated compliance dimension is absent across all 14 surveys, reflecting a broader gap between technical agentic research and the regulatory frameworks (NIST AI RMF, ISO 42001, EU AI Act, CCPA, and others) that increasingly govern deployment across demographics. Our survey addresses this gap by incorporating seven of the eight dimensions into a single defensive cybersecurity operations framework.

4. Agentic AI: Capabilities, Failure Modes, and Mitigations

This section defines agentic AI and its capabilities, and introduces a four-category domain-agnostic failure taxonomy: three causal axes (natural, system, adversarial) examined here in detail, and a regulatory consequence axis (compliance) that we summarize here and discuss in depth in Section 8, after regulated deployment contexts are established in Section 6 and Section 7. We integrate research-backed mitigation strategies and align each with operational compliance frameworks.

4.1. Capabilities and Lifecycle

Agentic AI refers to autonomous systems that demonstrate goal-oriented behavior through perception, reasoning-based planning, and action within dynamic environments while utilizing memory [1]. Architecturally, modern agents extend a Large Language Model (LLM) that serves as the reasoning core, augmenting it with memory, tool interfaces, and orchestration logic that enable persistent state, external action, and feedback-driven revision. These systems operate in single- or multi-agent system (MAS) architectures, where specialized agents collaborate to achieve complex goals. As illustrated in Figure 2(A), agentic AI systems follow a dynamic, iterative lifecycle composed of five phases (each representing a core operational capability) that loop back from reflection to perception upon error detection [52,121,149].

These capabilities collectively enable agentic systems to handle tasks that are multi-step, tool-dependent, context-sensitive, and require adaptive reasoning, as well as non-deterministic functionalities that cannot be achieved through static automation. In MAS configurations, agents apply these capabilities to specialized roles coordinated through task delegation, enabling complex workflows that would otherwise require manual coordination across specialists. The degree to which these capabilities are exercised varies across deployments. Some systems invoke only a single inference step, while others execute long, autonomous loops with extensive tool use. Table 2 captures this spectrum across four autonomy levels (0–3), distinguishing systems by how predictably their execution paths can be enumerated.

4.2. Failure Taxonomy

Deploying MAS reliably requires addressing failures, which we define as any deviation from intended behavior, safety constraints, or operational requirements that arises during the lifecycle phases. Kumar et al. [123], in a joint effort between Microsoft and the Berkman Klein Center, established a foundational two-category taxonomy that classifies ML failures as either intentional (caused by an active adversary) or unintentional (produced by inherent system limitations). This binary distinction provided a common vocabulary across engineering, policy, and legal communities, but also conflates two fundamentally different causal origins within “unintentional”: natural failures inherent to the underlying model limitations (e.g., hallucination, reasoning degradation) and systemic failures attributable to engineering design and deployment decisions (e.g., poor orchestration, insufficient verification), each demanding different mitigation strategies and different accountable stakeholders. Furthermore, Cemri et al. [16] analyzed over 1,600 multi-agent execution traces to produce the MAS Failure Taxonomy (MAST), identifying 14 failure modes clustered into specification and design issues, inter-agent misalignment, and task verification failures. Critically, specification and coordination deficiencies, not underlying model capability, account for the majority of observed failures, confirming that preventable engineering choices dominate system reliability and warrant a distinct causal category. Building on these foundations and drawing from the OWASP [33], Microsoft’s AI failure-mode taxonomy [83], and domain-specific failure analyses, we develop a four-category failure taxonomy: three causal (natural, system, adversarial) spanning 18 sub-categories and 72 modes, and a regulatory consequence axis (compliance) with 4 sub-categories and 20 modes. The full taxonomy is illustrated in Figure 2(B–C); compliance is detailed in Section 8 after deployment scope establishment.

This taxonomy splits “unintentional” category into Natural failures (architectural limitation) and System failures (engineering problem), while their “intentional” category becomes Adversarial failures (security problem). Co-manifestation is common in practice; for example, a natural hallucination may be indistinguishable from an adversary-induced one. The taxonomy resolves this by classifying by causal origin, not by observable symptoms. Compliance failures sit on a separate axis and cannot manifest until deployment within a regulated scope, so we defer them to Section 8 after cyberops research and practices are established. The following three subsections examine each causal category in detail across the 18 sub-categories and 72 failure modes ([4, 16] natural, [8, 31] system, and [6, 25] adversarial).

4.2.1. Natural Failures

We organize 16 natural failure modes under four sub-categories based on their causal origin. This classification incorporates key aspects such as data, training, input [50,56], model decomposition [71], and context handling [74]. Refining these for MAS deployments, we identify 4 sub-categories of natural failure: the model itself (reasoning limitations), its learned knowledge (data and knowledge gaps), the input interface (inference errors), and the architecture limitations (context constraints). Figure 3 visualizes the resulting architecture-to-lifecycle mapping for downstream impact and mitigation analysis; Table 3 catalogs each mode, its impacted lifecycle phase with description.

Security Implications: First, agentic perception and planning limitations warrant research attention, as reasoning is the key driver of agent effectiveness and has been most extensively demonstrated across numerous studies [50,56,71]. The severity of their consequences differs between regular inference and MAS settings: a hallucination in regular inference can be mere noise, whereas a hallucinated tool call can trigger irreversible real-world action [104]. In agentic contexts, hallucination is therefore unacceptable and is a threat to integrity instead of being within acceptable threshold.

Second, the four sub-categories differ in their proximity to mitigation. Data and knowledge limitations, as well as context constraints, are partially addressed through retrieval-augmented generation (RAG) [69], hierarchical memory [45], and context management pipelines [74], even though the underlying limitations persist. Reasoning limitations and input quality failures, by contrast, manifest at architectural layers where mitigation is harder: calibration [145], non-determinism [60], and ambiguity resolution [16] are all directly impacted by model training/fine-tuning or design.

Third, the cluster in Figure 3 reveals an asymmetric distribution across lifecycle phases. Perception is affected by all four limitation sources because it is the boundary at which both inputs and learned knowledge are first invoked. Memory is affected exclusively by context architecture, since natural failures in memory mechanisms are inseparable from the context window and attention mechanism that govern them. Planning appears in 11 of 16 modes, the most of any phase, because reasoning, retrieval, and contextual integration all converge during plan construction. Reflection inherits errors from upstream phases but rarely originates new natural failures.

4.2.2. System Failures

This arises from wrong design decisions, not from inherent model limitations, and are preventable through better engineering. We organize 31 failure modes following Microsoft AIRT [83] into eight sub-categories, as summarized in Table 4. Figure 4 maps each agentic lifecycle phase to the engineering deficiency that originates there.

Second, system failures originate at design time but manifest at runtime, often several lifecycle phases removed from the design decision that caused them. Specification ambiguity ([fm:S.1.3]S.1.3) surfaces as planning-phase oscillation; over-permissive role definitions ([fm:S.7.1]S.7.1) surface as unauthorized tool actions; missing circuit-breakers ([fm:S.2.4]S.2.4) surface as cascading multi-agent failures [33]. This origin-consequence gap is most pronounced for tool and memory surfaces, both of which aggregate state across the entire lifecycle and propagate defects far from their introduction point. Third, the failure surface expands sharply in multi-agent topologies. All 31 modes are applicable to multi-agent deployments, primarily concentrated in workflow orchestration ([fm:S.2]S.2) and inter-agent coordination ([fm:S.3]S.3). A single agent cannot ignore peer outputs, drift from shared objectives, or deadlock on inter-agent dependencies; these failures are topology-induced [16,119]. Every agent-to-agent/tool interaction in a MAS constitutes an implicit trust assumption [87].

Fourth, the lifecycle distribution differs structurally from natural failures. Natural failures concentrate at Perception and Planning; system failures concentrate at Planning, Action, and Reflection, where tool integration, access control, and output handling manifest. Hence, controls aimed at perception will fail to address system failures, and controls at integration layers (tool invocations, state transitions) will fail to address natural failures. The two categories require mitigation through largely disjoint channels [129,138].

Fifth, system failures cascade across sub-categories. A schema mismatch ([fm:S.4.2]S.4.2) produces incorrect output parsing ([fm:S.4.3]S.4.3), which corrupts memory ([fm:S.5.1]S.5.1), which in turn drives subsequent decisions based on stale state ([fm:S.5.2]S.5.2). In MAS settings, coordination failures ([fm:S.3]S.3) propagate through orchestration ([fm:S.2]S.2) into cross-agent state collusion ([fm:S.3.3]S.3.3) or inconsistency ([fm:S.5.4]S.5.4). MAST documents these chains empirically [16]; treating modes in isolation underestimates the actual fault surface, since breakdowns typically involve multi-mode chains rather than single-mode failures [115,129].

4.2.3. Adversarial Failures

This results from intentional exploitation by an active adversary seeking to subvert agent behavior for malicious purposes. We organize 25 modes into 6 sub-categories, as summarized in Table 5. Figure 5 maps each sub-category to the NIST Gen. AI 100 [100], showing which agentic lifecycle phases it targets.

Threat model: We consider a capability-tiered threat model spanning four independent capability dimensions, each mapped to a distinct attack surface. Black-box query access (tier-1) limits the adversary to the agent’s public input interface, where they craft prompts or provide manipulated content ingested during normal operation. Data channel access (tier-2) allows the adversary to inject or modify content in external sources the agent retrieves, including knowledge bases, RAG corpora, vector stores, and persistent memory. Tool and environment access (tier-3) enables compromise of tools, plugins, third-party servers, or environmental inputs such as file systems and API responses. Multi-agent access (tier-4) permits the adversary to compromise, impersonate, or inject agents within a multi-agent architecture, exploiting trust relationships and communication channels. Output and access exploitation and resource attacks are consequences achievable at any of the four access tiers rather than independent levels. The defender’s objective across all categories is to maintain secure operations by upholding the four NIST GenAI security properties.

Security Implications: Five observations emerge from this organization, each grounded in the capability-tiered threat model. First, adversarial failures have the strongest quantitative evidence base of the three causal categories, with published attacks reporting concrete success rates at every access tier: HOUYI compromised 31 of 36 production applications at the black-box tier [76]; AgentPoison achieved over 80% retrieval success at under 0.1% poisoning rate at the data-channel tier [17,151]; McHugh et al. [80] demonstrated hybrid XSS/CSRF injection at the tool tier; and Lee et al. [68] showed self-propagating prompt infection at the multi-agent tier. These rates establish that adversarial failures are reproducible at high confidence against production systems across all four access levels.

Second, attack persistence and stealth increase with adversary access and capabilities. Black-box attacks (tier-1) are visible in input logs and require per-session re-injection. Data-channel attacks (tier-2) persist in retrieval corpora and activate repeatedly without attacker presence; AgentPoison [17] and BadAgent [142] both demonstrate dormant payloads that survive across sessions. Tool and environment attacks (tier-3) operate below the agent’s reasoning layer, injecting false observations that the agent cannot distinguish from legitimate responses [49]. Multi-agent attacks (tier-4) exploit established trust relationships, making malicious messages indistinguishable from legitimate peer coordination [83,134]. The security implication is that higher-tier attacks require fundamentally different detection strategies: input filtering suffices for tier-1, tier-2 and tier-3 require provenance verification, tool-output validation, but tier-4 requires authenticated integration layer such as inter-agent communication validator or consensus channels due to adversary possessing insider threat characteristics.

Third, indirect attack vectors dominate the agentic threat surface. Standalone LLM safety research has historically focused on direct jailbreaks (tier 1) [105,150], but agentic deployments expose a wider indirect surface across tiers 2–4: retrieved documents, tool outputs, peer-agent messages, and persistent memory all accept external content that the agent treats as trusted. Greshake et al. [41] established the foundational XPIA taxonomy; Microsoft AIRT identifies indirect injection as the most significant agentic failure mode [83]. The lifecycle distribution confirms this: Perception is the entry point for 7 of the 25 modes because it is the phase where untrusted external content enters the reasoning loop.

Fourth, 6 of the 25 modes are exclusive to multi-agent deployments (tier-4), mirroring the topology-induced expansion observed for system failures (10 of 31 modes in Section 4.2.2). The security implication differs qualitatively: system-failure expansion introduces unintentional breakdowns, whereas adversarial expansion introduces exploitable trust surfaces. Lee et al. [68] demonstrated that prompt infection self-propagates via logistic growth, with stronger models becoming more effective vectors once compromised. Inter-agent trust thus becomes a lateral-movement channel; every unverified agent-to-agent interaction constitutes an implicit trust assumption exploitable at this tier [55,87].

Fifth, the two consequence categories, output/access exploitation ([fm:A.5]A.5) and resource attacks ([fm:A.6]A.6), are reachable from any access tiers rather than requiring a specific entry point. A black-box injection can exfiltrate data just as a compromised tool can; a data-channel poison can trigger unbounded consumption just as a multi-agent jailbreak can. This tier-independence means the consequence categories threaten all four NIST GenAI properties simultaneously: integrity (corrupted reasoning), privacy (data exfiltration), availability (resource exhaustion), and resistance to misuse (unauthorized action execution). Defending against consequences alone is thus insufficient without controlling each tier independently. Compounding this, adversarial campaigns routinely chain tiers: a tier-1 prompt injection can seed tier-2 memory poisoning that activates tier-3 tool actions, with each transition inheriting trust from the prior [83,134]. Tier-wise hardening must protect against both initial compromise and payload propagation from lower tiers.

4.3. Mitigation Strategies and Compliance Alignment

The preceding sections (Section 4.2.1, Section 4.2.2 and Section 4.2.3) catalog what can go wrong; we now address how to prevent it. Furthermore, a mitigation must also be compliant with authorized standards. Table 6 maps each of the 18 causal failure modes to mitigation strategies and aligns each with operational compliance frameworks: NIST AI RMF [93], NIST SP 800-207 Zero Trust Architecture [113], ISO/IEC 27001 [53], ISO/IEC 42001 [54], SOC 2 [4], GDPR [31], and the EU AI Act [32]. Natural-failure mitigations are probabilistic (reducing but not eliminating inherent limitations), while system and adversarial mitigations admit deterministic controls auditable against compliance baselines. The defense-in-depth principle endorsed by NIST, OWASP, and Microsoft AIRT requires that at least two complementary controls cover each sub-category. Hence, no single mitigation addresses any sub-category in isolation. As system failures cascade across sub-categories (Section 4.2.2) and adversarial campaigns chain across access tiers (Section 4.2.3), the listed controls must function compositionally: hardening one sub-category in isolation leaves adjacent sub-categories as exploit pivots. We considered answers to RQ-1 while formulating persistent challenges and proposing future research (Section 9).

5. Defensive Cybersecurity Operations: Lifecycle, Task Categorization, and Automation

Defensive cybersecurity operations comprise the continuous and structured processes through which organizations monitor, detect, investigate, and neutralize threats to their digital infrastructure [96,133]. These operations are typically centralized within SOCs, where analysts work across heterogeneous tool-chains, solutions, and threat intelligence feeds [61]. Identifying where agentic systems can intervene effectively requires a principled characterization of the operations lifecycle and its constituent tasks. Hence, structured alignment determines where automation is tractable and where deployment risks are concentrated. This section establishes that alignment in three steps. Section 5.1 defines a simplified defensive cybersecurity lifecycle grounded in established frameworks [22,131]. Section 5.2 decomposes the lifecycle into 13 disjoint operational tasks classified by cognitive demand and automation feasibility. Section 5.3 maps each task to agentic capabilities and human oversight level from Section 4.1, the dominant failure exposures from Section 4.2.1, Section 4.2.2 and Section 4.2.3, establishing the automation scope with mitigation from Section 4.3. This approach leads to the identification of agentic cyberdefense use cases in Section 6.

5.1. Defensive Cybersecurity Operations (CyberOps) Lifecycle

Defensive cybersecurity operations are the sequence of activities through which an organization detects, investigates, responds to, and learns from security incidents [22]. We adopt a simplified three-phase lifecycle (Detection, Analysis, and Eradication) grounded in NIST SP 800 [22] and operationalized through MITRE D3FEND [131], and the NIST CSF 2.0 [94]. These frameworks specify finer-grained taxonomies, suited to control-level mapping and audit. We consolidate at the activity level to keep our focus on where agentic AI integrates rather than on operational sub-decomposition. Knowledge sharing is a cross-cutting feedback and recovery mechanism rather than a discrete phase, reflecting its continuous operation across stages as new findings, updates, and policies propagate back into detection modules, threat repositories, and configurations. Figure 6 illustrates this structure in a simplified yet detailed manner.

The defensive cybersecurity operations lifecycle is inherently iterative rather than linear. A single incident commonly cycles between Analysis and Detection as containment actions in the Eradication phase surface new indicators, while Knowledge Sharing outputs (refined detection rules, updated playbooks, and enriched CTI feeds) directly modify Detection thresholds for subsequent incidents. This iterative, stateful character distinguishes defensive cyber operations from tasks amenable to static, single-pass automation, and it establishes the fundamental case for agentic systems capable of maintaining coherent state across phases and adapting behavior in response to novel evidence.

5.2. Task Categorization Framework

Effective multi-agent system integration into the existing cyberops lifecycle requires decomposing discrete operational tasks and characterizing each input-output structure in terms of its cognitive demands and automation feasibility. We categorize tasks along two dimensions to facilitate better alignment of automation in (Section 5.3). First is cognitive demand, from Rasmussen’s skill-rule-knowledge taxonomy of human performance [108]. Mechanical tasks are high-volume, deterministic, rule-based, without ambiguity, making them amenable to direct automation with minimal reasoning overhead. Cognitive tasks are reasoning-intensive, context-dependent, and require multi-step inference or domain judgment that cannot be reduced to symbolic enforcement. Composite tasks combine mechanical execution with cognitive judgment, requiring systems that can both act through tool invocation and reason over the results.

Second is automation feasibility, from Parasuraman et al. [103], which links automation level to consequence severity, reversibility, and required human oversight. High indicates that agentic systems can perform the task with minimal human oversight. Moderate indicates that agentic assistance substantially reduces cognitive burden, but human validation of consequential outputs remains appropriate given current limitations. Low indicates that agentic systems can augment but not replace human judgment, and human-in-the-loop control is mandatory. Low designation reflects the severity and accountability of consequences rather than computational intractability: the cost of an agentic failure (Section 4.2) in these tasks is critical or irreversible. Table 7 presents the resulting categorization.

We derive the task set by decomposing each phase against the activity categories of NIST SP 800-61, NIST CSF 2.0, and MITRE D3FEND, with each of the 13 tasks mapping to a distinct named activity cluster in at least one framework. Tasks are consolidated by analytical function: for example, root cause analysis (RCA) ([task:T-6]T-6) subsumes log querying, forensic artifact collection, and timeline reconstruction as a single cognitive unit, yielding a framework stable across SOC toolchain configurations. Furthermore, from this decomposition, three observations emerge. First, Detection tasks are Mechanical or Composite and High-feasibility, making them tractable for near-term agentic deployment; the bottleneck is input volume and heterogeneity, not reasoning depth. Second, Analysis tasks are Cognitive and moderately feasible, requiring the multi-step planning and external knowledge retrieval that distinguish agentic systems from static classifiers [69,149], while exposing them to causal failure modes (Section 4.2) such as reasoning degradation ([fm:N.1.3]N.1.3), knowledge staleness ([fm:N.2.1]N.2.1), and retrieval errors ([fm:S.5.3]S.5.3), and others. Third, Eradication and Knowledge sharing tasks span the full lifecycle: rule refinement ([task:T-11]T-11) and CTI dissemination ([task:T-13]T-13) are Moderate as outputs are advisory, while containment ([task:T-10]T-10) and policy update ([task:T-12]T-12) are Low as they invoke irreversible actions where excessive agency ([fm:S.7.1]S.7.1) and absent graceful degradation ([fm:S.2.5]S.2.5) carry the highest operational consequence.

5.3. Automation Scopes for Agentic AI

The case for agentic automation in defensive cyber operations is not made in phases but by tasks, and not by preference but derivation. For each task in Table 7, the tools it must invoke and the memory it must retain jointly determine the autonomy level (Table 2) at which an agent can operate. The autonomy level, combined with the agentic capabilities, defines the failure modes from Section 4 that become challenges. The challenges, in turn, dictate the mitigation (Table 6) and the compliance anchors that any deployment must satisfy. Oversight is the point of accountability, not an absolute mitigation. The remainder of this subsection traces the chain through each phase and consolidates the results in Table 8.

Detection is the phase where mitigations are mechanical and mature: schema enforcement at the perception boundary, AST-level tool-call validation [104], exponential-backoff retries, and periodic baseline re-validation suffice. Compliance maps cleanly to NIST AI RMF 2.4–2.5, SOC 2 CC6.1 and CC8.1, and ISO 27001 A.8.28. The Minimal-to-Advisory oversight gradient reflects a downstream-correction property: residual perception errors propagate as false positives or missed alerts that Analysis tasks can recover. Hence, the failure budget here is more generous than in later phases. [task:T-4]T-4 sits one level higher as behavioral baselines are themselves subject to drift ([fm:S.5.2]S.5.2) and training-data bias ([fm:N.2.3]N.2.3) that downstream tasks cannot transparently correct.

Analysis is where mitigations become probabilistic rather than deterministic. Required interventions span RAG grounding with provenance [69,86], self-consistency sampling and reflection [121], hierarchical memory with position-aware retrieval [45,74], dedicated verifier agents [16], and calibration-aware confidence reporting [145], none of which provide correctness guarantees. Multi-agent configurations partially absorb the uncertainty by parallelizing sub-tasks across specialized agents with an orchestrator synthesizing outputs, as demonstrated by FALCON [85], but cannot eliminate it. The compliance envelope broadens according to NIST AI RMF 2.3 and 2.7, ISO 42001, EU AI Act Article 15, and GDPR Article 22, where outputs influence decisions affecting individuals. The uniform advisory oversight reflects this irreducibility: layered mitigations bound but cannot eliminate plausible-but-incorrect reasoning chains.

Eradication splits along the action-reversibility boundary. Here, mitigation is dominated by deterministic access-control primitives drawn from zero-trust architecture: per-session least-privilege tokens [33,87], signed inter-agent manifests, audit logging [83], mandatory human approval gates, and continuous verification [113]. The compliance envelope is the strictest here, anchoring on NIST SP 800-207, SOC 2 CC6.1–CC6.3, GDPR Article 32, and EU AI Act Article 14. This combination forecloses higher autonomy regardless of model capability, illustrating the central inversion of this phase: oversight requirements set the autonomy ceiling rather than reasoning capability. Across all three tasks, memory integrity remains the silent failure point: containment grounded in incorrect incident context ([fm:S.5.1]S.5.1, [fm:S.5.2]S.5.2) produces strategies mismatched to the actual attacker footprint, regardless of access controls.

Knowledge sharing ([task:T-13]T-13) carries a dual asymmetry that distinguishes it from the other phases. Outward, dissemination of CTI has a low local blast radius but high ecosystem amplification: hallucinated indicators, biased TTP annotations, or unfiltered exfiltration propagate from the agent into shared repositories consumed by peer organizations. Inward, the same task channels back into the organization’s own SIEM configurations and recovery procedures, closing the loop. Mitigations, therefore, center on bidirectional integrity rather than execution control: provenance tracking, output validation [33], and pattern-based DLP filtering, consistency checks against existing data, and version-controlled rollback on the inward path. Compliance anchors span GDPR Article 5(1)(d), SOC 2 criterion C1, ISO 27001 A.5.23 for shared information governance, and ISO 27001 A.5.24–A.5.26 for the incident management lifecycle. The Advisory oversight reflects this dual asymmetry: dissemination is locally low-stakes but globally consequential, and feedback into operational defense is consequential but reversible through the same version controls.

5.3.0.1. Critical Insights:

The 13 fine-grained tasks aggregate into the five distinct task categories mapped onto the traditional cybersecurity ecosystem in Section 6 by analytical objective and shared tool/memory, based on the engineering question “how to safely realize autonomy, not how to maximize it?”. Threat Detection ([task:T-3]T-3, [task:T-4]T-4) shares telemetry-driven pattern matching. Alert Triage and Prioritization ([task:T-5]T-5) bridges alerts to investigative sequence. Investigation and Root-Cause Analysis ([task:T-6]T-6, [task:T-11]T-11) shares deep reasoning over incident state, pairing [task:T-11]T-11 with [task:T-6]T-6 across phases as both produce analytical artifacts rather than direct actions. Threat Intelligence and Reporting ([task:T-7]T-7–[task:T-9]T-9, [task:T-13]T-13) shares knowledge-product synthesis from long-term memory across Analysis and Knowledge Sharing phases. Response Automation ([task:T-10]T-10, [task:T-12]T-12) groups irreversible actions under Mandatory oversight. [task:T-1]T-1 and [task:T-2]T-2 cut across all five. Shared tools and memory yield shared failure exposures, where the autonomy–oversight relationship is non-monotonic.

6. Agentic AI for Defensive Cybersecurity: Research Landscape and Limitations

Building on Section 5.3, this section reviews existing agentic research across five aggregated operational categories. For each, we summarize the surveyed sub-directions and identify research opportunities against the autonomy and oversight bounds of Section 5; per-work contributions and drawbacks are cataloged in Table 9. Proactive threat discovery and pre-incident or offensive simulation fall outside the incident-driven defensive scope, requiring a parallel offensive pipeline. Readers interested in agentic AI for vulnerability detection, a related but distinct problem area, can consult [120].

6.1. Threat Detection

Threat Detection operates at autonomy Level 1–2, with residual perception errors recoverable downstream. Existing works spans log parsing addressing input-quality failures ([fm:N.3.2]N.3.2) [78,144], anomaly detection with parameter-efficient fine-tuning across open-source backbones [110,112], and deep-learning intrusion classifiers for fine-grained attack-type identification [34,66]. Drawbacks recur across the category: historical benchmarks do not reflect contemporary distributions, providing limited assurance against obfuscated and polymorphic variants ([fm:N.2.1]N.2.1, [fm:N.2.2]N.2.2); the open-source–proprietary gap is reported [110,112] but never decomposed into the model properties that drive it: calibration ([fm:N.1.4]N.1.4), prompt sensitivity ([fm:N.1.6]N.1.6), and instruction-following; and KG-augmented classifiers [66] convert one-time integration into recurring enrichment burden ([fm:N.2.1]N.2.1) without automated curation. Further research opportunities include operational-condition benchmarks measuring detection under continuous high-volume input rather than static datasets; adversarial benchmarks treating obfuscated, metamorphic, and zero-day samples as first-class; and inference-cost-aware deployment pairing learned verification with grounded-decoding constraints.

6.2. Alert Triage and Prioritization

Alert Triage bridges Detection and Prioritization under Advisory oversight, spanning agentic overlays on classical classifiers [3], learning-from-analyst-decisions via RL and imitation learning [135,141], and MAS architectures with specialized roles [114,143]. Two drawbacks emerge: first, explanation-without-action, where interpretability artifacts are produced as analyst aids without coupling to SIEM ranking actions, leaving the analytical work of triage short of the operational outcome ([fm:S.6.2]S.6.2); and surrogate-metric evaluation that does not measure analyst latency, decision accuracy, or alert closure quality ([fm:S.6.1]S.6.1). The frozen-policy problem in imitation learning [135] compounds both, exposing stale-state retention ([fm:S.5.2]S.5.2) and over-reliance ([fm:N.2.4]N.2.4) as analyst norms shift; multi-agent topologies further activate workflow-management failures ([fm:S.2.1]S.2.1) under production load. Research opportunities include operational user studies on the impact of analyst workflow on triage; policy-adaptation mechanisms that update playbook based on observed analyst behavior within governed bounds ([fm:N.2.3]N.2.3); and loop-closing integrations between explanation and action.

6.3. Investigation and Root Cause Analysis (RCA)

Investigation and RCA is the only category admitting Level 3 autonomy via [task:T-6]T-6’s cyclic root-cause reasoning, spanning multimodal anomaly correlation [11] and retrieval-augmented multi-agent investigation [12,18]. However, multimodal works assume simultaneous availability of all labeled modalities and do not inherently address sensor failure or modality dropout ([fm:N.3.3]N.3.3); retrieval-augmented systems inherit a bounded-knowledge dependency (CyberRAG [12] fixed to a predefined taxonomy, OMNISEC [18] hallucinating under sparse external knowledge), jointly exposing multi-step reasoning degradation ([fm:N.1.3]N.1.3), RAG retrieval errors ([fm:S.5.3]S.5.3), and overconfidence on partially grounded conclusions ([fm:N.1.4]N.1.4); and none implements [task:T-11]T-11 as an explicit feedback artefact, leaving investigation findings as analytical outputs that analysts must manually translate into Detection updates. Therefore, graceful degradation under partial modality availability ([fm:S.2.5]S.2.5); open-set detection formulations flagging anomalies outside known taxonomies ([fm:N.2.2]N.2.2); and closed-loop pipelines propagating findings into SIEM rules, instantiating [task:T-11]T-11 as a first-class output, remain open research problems.

6.4. Threat Intelligence and Reporting

Threat Intelligence and Reporting synthesizes knowledge products from long-term memory, spanning CTI extraction and contextualization via RAG [19,86], parametric knowledge infusion through curriculum training on threat reports [75], and log-to-narrative summarization [8]. Most works implements individual stages (parsing, extraction, summarization) without end-to-end integration; the one cascading approach lacks intermediate-step validation. Input-quality assumptions go invalidated across stage boundaries: LocalIntel [86] on local-KB completeness ([fm:S.5.3]S.5.3), CTINexus [19] on rare-entity coverage ([fm:N.2.2]N.2.2), CyLens [75] on cascading reasoning without intermediate validation ([fm:N.1.3]N.1.3, [fm:S.6.2]S.6.2), and CYGENT [8] on manual upload within fixed token context ([fm:N.4.1]N.4.1, [fm:N.4.3]N.4.3); evaluation uses static retrospective reports rather than streaming production input; and the category has the broadest blast radius in the lifecycle, with hallucinated indicators ([fm:N.1.1]N.1.1) and biased TTP annotations ([fm:N.2.3]N.2.3) propagating into shared CTI repositories that peer organizations consume ([fm:A.5.1]A.5.1). Yet, no surveyed work proposes outbound provenance tracking or output validation. Hence, future research may include end-to-end pipeline integration with inter-stage quality controls; streaming-condition evaluation protocols; and provenance and outbound-integrity mechanisms to address the ecosystem-amplification.

6.5. Response Automation

Response Automation is the integration frontier where compliance rather than reasoning capability sets the autonomy ceiling, spanning agent-based propagation simulation [62], LLM–SOAR integration with playbook-driven orchestration and PGM validation [36,43], and RL policies including hierarchical MARL [122] and LLM–MARL fusion for cyber-physical defense [147]. Drawbacks explain why no surveyed system has reached production: simulation-only validation (CybORG [127], simulated cloud) does not capture the irreversibility distinguishing [task:T-10]T-10/[task:T-12]T-12 from advisory tasks; rule-based and playbook-anchored systems do not adapt to novel variants, exposing excessive agency ([fm:S.7.1]S.7.1) under specification weakness ([fm:S.1.4]S.1.4), and PGM validation reduces but does not eliminate hallucination on irreversible actions. In-context agent [36] lacks formal verification of irreversible actions ([fm:S.6.2]S.6.2), and L2M-AID [147] leaves adversarial robustness unaddressed against XPIA ([fm:A.1.2]A.1.2) and training-data poisoning ([fm:A.2.1]A.2.1); and the highest-stakes failure modes for this category, namely HITL bypass ([fm:A.5.3]A.5.3), trust-boundary mismanagement ([fm:S.7.2]S.7.2), privilege escalation ([fm:A.5.2]A.5.2), and cascading failure ([fm:S.2.4]S.2.4), remain untested as no surveyed system executes the production actions at which they manifest. Opportunities, jointly preconditional for production deployment: constrained-action frameworks integrating per-session least-privilege tokens, signed manifests, and tamper-evident logging [33,87]; adaptive playbook learning within human-approved boundaries; sim-to-real bridging methodologies preserving recovery-cost guarantees; and adversarial robustness evaluation against prompt injection and poisoning at the deployment surface [83].

7. From Research to Practice: Commercial Landscape of Agentic Cyberdefense

Where Section 6 examined academic research, this section examines “what major vendors have brought to the market?”. The motivating question is not whether industry has adopted agentic AI in defensive cybersecurity, but where commercial implementations sit relative to the scholarly autonomy failure exposures (Section 4) and oversight bounds (Section 5). Industry offerings provide a different kind of evidence than scholarly research: vendors report metrics from production deployments, but typically without the methodological detail or independent validation that a comprehensive analysis requires. The analysis proceeds in three steps. Section 7.1 maps the commercial landscape to the five categories of Section 6; Section 7.2 surfaces convergent and divergent design choices that reveal which tasks have crossed the agentic adoption threshold; Section 7.3 identifies maturity gaps between vendor claims and the failure-exposures.

7.1. Current Commercial Landscape

Commercial offerings concentrate where SOC budgets and operational metrics most clearly justify investment, organizing into three sub-directions [136] cataloged in Table 10. Detection and triage platforms [25,28,111,117] target [task:T-1]T-1–[task:T-5]T-5 on vendor-controlled telemetry substrates, automating Tier-1 and Tier-2 SOC work under bounded autonomy. Analyst-augmentation copilots [21,23,82] target Investigation, CTI, and Reporting ([task:T-6]T-6–[task:T-9]T-9, [task:T-13]T-13) by stratifying analyst speed and accuracy gains across experience levels. End-to-end orchestration platforms [51,95,125] target the full Detection-to-Response chain ([task:T-1]T-1–[task:T-13]T-13) through SIEM, SOAR, and ML-driven scoring with cognitive correlation across logs, alerts, and external threat intelligence. Each row in Table 10 reports vendor-disclosed status without independent validation; we treat these as evidence of claimed capability and revisit the validation gap in Section 7.3.

7.2. Shared Design Patterns and Architectural Divergences

Three convergent design choices and two divergences mark the current position of the production frontier. Convergences: all surveyed platforms ground autonomous reasoning in a vendor-controlled telemetry substrate (Falcon for Charlotte, GreyMatter’s correlation layer, Darktrace’s ActiveAI baseline, Singularity for Purple AI, Chronicle’s data lake, Cortex’s unified data store), addressing the input-quality gap that constrains the open research of Section 6.1 but tying agentic capability to vendor lock-in; all expose human-in-the-loop checkpoints for irreversible actions (Charlotte’s customer-defined SOAR guardrails, GreyMatter’s bounded Tier-1/Tier-2 automation, Purple AI’s analyst-in-the-loop governance, Microsoft Copilot’s analyst-authorized remediation, Cortex AgentiX’s role-based approvals), instantiating the Mandatory oversight regime that Section 5.3 identifies for [task:T-10]T-10 and [task:T-12]T-12; and all emphasize multi-framework compliance posture (SOC 2 Type II, ISO 27001, FedRAMP), reflecting the convergent regulatory finding of Section 4, though we only found Microsoft and IBM to publish specific failure-mode coverage tied to those frameworks.

Divergences are analytically more revealing. The first concerns the autonomy ceiling: Darktrace’s autonomous endpoint mitigation and Palo Alto Cortex XSIAM’s end-to-end orchestration push toward Level 2–3 deployable autonomy in Response Automation, while Charlotte AI, GreyMatter, Purple AI, Microsoft Copilot, Cisco AI Assistant, and Splunk AI Assistant remain explicitly bounded to Level 1 with analyst gating. This is the integration-frontier question of Section 6.5 reframed: whether containment and policy update can be safely raised above Level 1, with vendors taking opposite positions. The second concerns the reasoning substrate: IBM QRadar Advisor, Google Sec-PaLM, Microsoft Security Copilot, Cisco AI Assistant, Splunk AI Assistant, and SentinelOne Purple AI lean on LLM reasoning over structured telemetry and agentic tooling (CTI synthesis, log narration, query generation), while CrowdStrike Charlotte, ReliaQuest GreyMatter, and Darktrace ActiveAI lean on behavioral statistical models with LLMs as an explanation overlay. The first treats the LLM as the analytical core. It inherits the natural failure profile of Section 4.2.1 (reasoning degradation [fm:N.1.3]N.1.3, knowledge staleness [fm:N.2.1]N.2.1, factual hallucination [fm:N.1.1]N.1.1); the second treats the LLM as an explanation overlay and inherits the explanation-without-action gap that Section 6.2 identifies for the open literature.

7.3. Persisting Maturity Gaps

Vendor-reported metrics show that commercial agentic AI delivers measurable operational gains, but four maturity gaps separate vendor claims from the methodological standard applied to the academic research surveyed in Section 6. Vendor-internal metrics, namely triage accuracy above 98% (Charlotte AI), MTTR reductions of 30% (Security Copilot), alert processing 20× faster with 30% greater accuracy (GreyMatter), and 80% reduction in alert volume requiring analyst review (Cortex XSIAM), are presented without third-party reproducibility on shared datasets or protocol-level disclosure, though several vendors release methodology footnotes (CrowdStrike) and commissioned third-party studies (Microsoft RCTs, Forrester TEI for ReliaQuest and Palo Alto); this falls short of the shared-dataset, disclosed-protocol evaluation of the research in Section 6.1. The failure-exposure profile of Section 4 is largely unaddressed beyond general guardrails and compliance certifications: no surveyed offering publishes specifications for HITL bypass detection ([fm:A.5.3]A.5.3), trust-boundary enforcement ([fm:S.7.2]S.7.2), privilege-escalation prevention ([fm:A.5.2]A.5.2), or cascading-failure containment ([fm:S.2.4]S.2.4), even though several execute the high-blast-radius actions where these failure modes are consequential. The agentic-capability claim itself is uneven: while Charlotte AI, GreyMatter, Purple AI, Security Copilot, Darktrace ActiveAI, and Cortex XSIAM with AgentiX exhibit perception–planning–action–memory–reflection in operational deployment, Sec-PaLM, Cisco AI Assistant, and Splunk AI Assistant function as analyst copilots with retrieval augmentation rather than full agentic loops, and the boundary between agentic systems and LLM-augmented analytics tools is not consistently enforced across vendor messaging. Finally, exposure of cross-vendor agentic communication protocols (MCP, A2A, ACP) [30] remains nascent (Microsoft’s MCP server in Sentinel is an early exception); commercial agents largely operate within their vendor’s ecosystem rather than across organizational boundaries. These gaps do not negate the operational value vendors deliver; they mark where claims-of-capability and evidence-of-capability are not yet aligned, and where the compliance implications surveyed in Section 8 and the research directions of Section 9 must collectively land before agentic AI moves from vendor-bounded copilot deployment to cross-organizational defense infrastructure.

8. Compliance Implications for Multi-Agent Defensive Operations

Compliance failures are not a fourth root cause alongside Section 4’s causal categories but a consequence layer: they emerge when upstream technical failures manifest in regulated contexts, producing legal or governance risk. They can also arise independently of any technical fault [90]: an agent processing data flawlessly may lack a lawful basis under GDPR [31] or make high-stakes decisions without the human oversight required by Article 14 of the EU AI Act [32]. This dual origin justifies a separate analytical dimension. Section 8.1 catalogs the 20 compliance failure modes across four dimensions; Section 8.2 synthesizes how they interact with the technical taxonomy and where research and policy progress are jointly required. Table 11 consolidates the full mapping to the GDPR, EU AI Act, NIST AI RMF [93], ISO 42001, and sector-specific frameworks (HIPAA, PCI-DSS, SOX), with upstream cross-referenced technical triggers.

8.1. Compliance Failure Mode Taxonomy

We organize compliance failures into four dimensions: Privacy and Sovereignty, Transparency and Explainability, Accountability and Audit, and Fairness and Governance. This four-way partition reflects the principles around which global AI ethics frameworks converge [58]; the fifth converged principle, non-maleficence, we treat upstream as technical failure (Section 4.2.1, Section 4.2.2 and Section 4.2.3). Each catalogs the failure modes within one dimension, the regulatory provisions they trigger, the dominant gap separating current agentic systems from compliance, and the resulting research opportunities, with upstream technical triggers noted inline where they act as causal antecedents.

8.1.1. Privacy and Sovereignty

failures ([fm:C.1.1]C.1.1–[fm:C.1.5]C.1.5) arise when agentic systems handle PII data without satisfying the requirements of lawfulness, transparency, or territorial constraints. Five modes recur: processing without lawful basis ([fm:C.1.1]C.1.1) under GDPR Art. 6; cross-border transfer violations ([fm:C.1.2]C.1.2) routing data through non-adequate jurisdictions or violating localization mandates; failure to honor data subject rights ([fm:C.1.3]C.1.3) where agentic memory rarely exposes the erasure, access, and rectification mechanisms required by GDPR Arts. 15–17, a problem machine unlearning [13,97] addresses for model weights but leaves prompt caches, embedding stores, and RAG indices largely unaddressed; retention beyond lawful period ([fm:C.1.4]C.1.4, overlap with [fm:S.5.2]S.5.2) when long-term memory accumulates personal data without retention enforcement; and unintended PII ingestion ([fm:C.1.5]C.1.5, overlap with [fm:A.5.4]A.5.4) when agents ingest logs, screenshots, or telemetry containing personal data outside the declared purpose, with training-data extraction [15] showing ingested PII is recoverable from LLM internals. The dominant gap is that no surveyed agentic framework (Section 6) explicitly provides purpose-binding, retention, or erasure primitives on agent memory; routing prompts through external LLM APIs (Section 6.4) adds a further sovereignty surface that compliance frameworks have not yet caught up with.

8.1.2. Transparency and Explainability

failures ([fm:C.2.1]C.2.1–[fm:C.2.4]C.2.4) arise when agentic decision-making cannot be reconstructed for regulators, auditors, or affected parties. Four modes recur: inability to explain agent decisions ([fm:C.2.1]C.2.1) under GDPR Art. 22 and EU AI Act Art. 13’s transparency obligations for high-risk systems [40]; failure to disclose AI involvement ([fm:C.2.2]C.2.2) under EU AI Act Art. 50 when natural persons interact with AI systems without notification; opaque multi-agent reasoning chains ([fm:C.2.3]C.2.3, overlap with [fm:S.7.3]S.7.3) where causal lineage spans multiple unlogged model invocations; and insufficient training-data provenance ([fm:C.2.4]C.2.4) under EU AI Act Art. 10 when providers cannot demonstrate representativeness, completeness, and lawful sourcing of training corpora, a gap that datasheets [38] and model cards [84] partially address for data and models in isolation but not for multi-agent inference chains. The dominant gap is in output verification and provenance-tracking mechanisms, identified as research opportunities in Section 6.3 and Section 6.4, which are prerequisites for transparency compliance. Their absence in deployment creates potential regulatory exposure.

8.1.3. Accountability and Audit

([fm:C.3.1]C.3.1–[fm:C.3.8]C.3.8) arise when responsibility for agentic actions is unclear, the audit trail is incomplete, or sector-specific controls are not met. Eight modes form three clusters. Liability and oversight: unclear liability attribution ([fm:C.3.1]C.3.1) where neither the deploying organization, the model provider, nor the framework integrator can be unambiguously held responsible [107]; absence of HITL for high-risk decisions ([fm:C.3.2]C.3.2, overlap with [fm:A.5.3]A.5.3) under EU AI Act Art. 14 for the irreversible-action tasks [task:T-10]T-10 and [task:T-12]T-12; and unattributable actions in multi-agent chains ([fm:C.3.3]C.3.3) where diffused responsibility prevents post-hoc attribution. Audit trail: incomplete or non-tamper-proof audit trails ([fm:C.3.5]C.3.5, overlap with [fm:S.7.3]S.7.3) violating SOC 2 CC7.2 and ISO 27001 A.8.15, which tamper-evident logging [24] could address but no surveyed agentic framework deploys; and absent model versioning and change-management records ([fm:C.3.7]C.3.7) violating ISO 42001 lifecycle clauses when behavior changes without traceable revision. Sector-specific: non-compliance with sector regulations ([fm:C.3.4]C.3.4) where agentic SOC platforms processing health, payment, or financial telemetry must additionally satisfy HIPAA, PCI-DSS Req. 10, or SOX §404; failure to conduct mandatory risk assessments ([fm:C.3.6]C.3.6) under EU AI Act Art. 9; and non-compliance with AI-specific standards ([fm:C.3.8]C.3.8) where NIST AI RMF and ISO 42001 controls are referenced in vendor marketing (Section 7) but not demonstrably implemented. The dominant gap is the auditability asymmetry of Section 4: deterministic engineering controls produce auditable artifacts, but the multi-step, multi-agent, multi-model nature of agentic systems generates audit surfaces that existing logging infrastructures struggle.

8.1.4. Fairness and Governance

failures ([fm:C.4.1]C.4.1–[fm:C.4.3]C.4.3) arise when agentic outputs result in disparate treatment, differential service quality, or undocumented bias risks for protected groups. Three modes recur: discriminatory outcomes violating equal-treatment laws ([fm:C.4.1]C.4.1, overlap with [fm:N.2.3]N.2.3 bias propagation) under Title VII, ECOA, or EU equality-law obligations when agentic decisions disproportionately disadvantage protected classes [10]; differential quality of service across demographic groups ([fm:C.4.2]C.4.2) where agentic SOC platforms exhibit unequal detection or response performance across populations defined by language, geography, or organizational scale, recasting the open-source–proprietary gap of Section 6.1 as a fairness concern when small organizations cannot access proprietary-tier protection; and failure to conduct bias impact assessments pre-deployment ([fm:C.4.3]C.4.3) under EU AI Act Art. 9 and NIST AI RMF GOVERN-1.4. The dominant gap is that fairness in cybersecurity-specific agentic systems remains undertheorized relative to consumer-facing AI [81]: the protected-class harms fairness law was designed for (employment, credit, housing, criminal justice) map imperfectly to security operations, yet disparate model performance reproducing social inequities applies directly to agentic SOC platforms whose differential coverage maps onto organizational and geographic stratification.

8.2. Failure Synthesis and Research Implications

The 20 compliance failure modes interact with the causal taxonomy in three structurally significant ways. Seven are consequence-layer failures with upstream technical triggers ([fm:C.1.4]C.1.4 compounding [fm:S.5.2]S.5.2; [fm:C.1.5]C.1.5 compounding [fm:A.5.4]A.5.4; [fm:C.2.3]C.2.3, [fm:C.3.3]C.3.3, and [fm:C.3.5]C.3.5 each compounding [fm:S.7.3]S.7.3; [fm:C.3.2]C.3.2 compounding [fm:A.5.3]A.5.3; [fm:C.4.1]C.4.1 compounding [fm:N.2.3]N.2.3), where upstream engineering directly reduces compliance exposure. The remaining 13 ([fm:C.1.1]C.1.1 lawful basis, [fm:C.2.2]C.2.2 AI disclosure, [fm:C.3.1]C.3.1 liability attribution, [fm:C.3.6]C.3.6 mandatory risk assessment, [fm:C.4.3]C.4.3 bias impact assessment, among others) are pure governance failures without technical antecedent, requiring procedural rather than algorithmic measures. The auditability asymmetry of Section 4 limits verification across both classes: deterministic controls yield binary, machine-checkable evidence; reasoning-quality controls yield statistical evidence requiring deployment-specific thresholds that are still not prescribed.

Closing the gap requires coordinated progress on three fronts. Engineering upstream failure modes admits the most concrete opportunities: purpose-bound memory architectures ([fm:C.1.4]C.1.4) tagging items with processing purpose and enforcing memory-layer retention, extending designs such as MemGPT [101]; right-to-erasure-aware long-term memory ([fm:C.1.3]C.1.3) supporting targeted deletion across embedding stores, RAG indices, and prompt caches; sovereignty-preserving inference orchestration ([fm:C.1.2]C.1.2) routing through jurisdiction-appropriate endpoints, generalizing on-premises CTI patterns [86]; end-to-end decision provenance ([fm:C.2.3]C.2.3) capturing causal chains across tool invocations in tamper-evident logs; cryptographically-signed action logs ([fm:C.3.5]C.3.5) satisfying SOC 2 and ISO 27001 evidentiary requirements; multi-agent attribution standards ([fm:C.3.1]C.3.1, [fm:C.3.3]C.3.3) assigning action-level responsibility in orchestrated workflows; and agent-native authentication protocols ([fm:C.3.1]C.3.1, [fm:C.3.3]C.3.3) beyond OAuth 2.0 session models for long-running agentic operations. Governance and procedural measures address failures without technical antecedent: audit-grade explanation interfaces ([fm:C.2.1]C.2.1) rendering agentic reasoning at granularity sufficient for regulator and affected-party scrutiny; training-data manifest standards ([fm:C.2.4]C.2.4) extending datasheets and model cards to multi-agent inference chains; sector-specific compliance overlays ([fm:C.3.4]C.3.4) translating HIPAA, PCI-DSS, and SOX controls into agentic implementation patterns; pre-deployment bias impact assessment templates ([fm:C.4.3]C.4.3) aligned with EU AI Act Art. 9 for cybersecurity-domain systems; and fairness-aware tier accessibility ([fm:C.4.2]C.4.2) addressing the inequity of small organizations bearing higher residual risk when proprietary-tier protection is out of reach. Standardization underpins both fronts: cybersecurity-specific fairness metrics ([fm:C.4.1]C.4.1, [fm:C.4.2]C.4.2) adapting disparate-impact analysis to security outcomes (detection-coverage, response-time, false-positive-rate parity), and deployment-specific risk thresholds operationalizing EU AI Act Art. 15’s “appropriate accuracy and robustness” obligation that frameworks currently leave undefined. Section 9 connects where these fronts admit research progress versus require policy intervention beyond research.

9. Open Challenges and Research Opportunities (Answer to RQ-3)

The preceding sections traced agentic AI for defensive cybersecurity from foundational definitions through commercial offerings and compliance. We consolidate research opportunities into eight directions (R-1 through R-8) across three categories: methodological foundations providing evaluation and verification primitives, currently lacking (R-1–R-3), engineering work translating these primitives into deployable architectures (R-4–R-6), and governance where engineering alone cannot deliver (R-7–R-8). Figure 8 integrates these directions into a unified governable MAS architecture.

9.1. Methodological Foundations

Three methodological gaps form the substrate on which engineering and governance directions both build: representative benchmarks, verifiable agentic reasoning, and characterized failure modes.

R-1: Operational-condition and adversarial evaluation benchmarks Surveyed systems rely on historical benchmarks that miss contemporary operational distributions. Three benchmark families are needed: operational-condition benchmarks measuring detection, triage, and investigation under continuous high-volume input (Section 6.1); adversarial benchmarks treating obfuscated, metamorphic, and zero-day samples as first-class, addressing the 90%+ adaptive-attack bypass rate [92]; and streaming-condition CTI benchmarks on production-scale input (Section 6.4). Research-led, but requires industry partners for production telemetry and policy bodies for adequacy thresholds.

R-2: Verification, grounding, and provenance for agentic reasoning The auditability asymmetry of Section 4 (probabilistic natural failures vs. deterministic system failures) caps autonomy on high-stakes tasks (Section 6.5). Four complementary thrusts: learned verification components adapting to new log distributions; grounded-decoding constraints bounding hallucination ([fm:N.1.1]N.1.1) without continuous KG enrichment; end-to-end decision provenance capturing causal chains in tamper-evident logs satisfying SOC 2 CC7.2 and ISO 27001 A.8.15 (Section 8.1.2); and retrieval-confidence calibration signalling insufficient external knowledge before action commitment (Section 6.3). Verification is the precondition for raising autonomy ceilings where action irreversibility caps deployment below model capability.

R-3: Failure-mode characterization beyond identification Several mature failure categories are identified but uncharacterized: the open-source–proprietary performance gap [110,112] is named but never decomposed into the model properties driving it; the conditions under which CYGENT-style rule-based verification fails or conflicts with model output are unspecified; and the boundaries where RAG systems transition from grounded to hallucinated under sparse external knowledge are unmeasured. Controlled characterization studies decomposing composite failures into proximate causes would enable principled deployment decisions rather than vendor-tier defaults.

9.2. Engineering and Deployment

Three engineering directions translate methodological primitives into deployable architectures: governance-aware memory, irreversibility-bounded response automation, and end-to-end deployment integration.

R-4: Memory and modality architectures for partial-availability operation Memory failures ([fm:S.5.1]S.5.1, [fm:S.5.2]S.5.2, [fm:S.5.3]S.5.3) compound where multimodal sources fail asynchronously and data arrive incomplete. Three facets of one architecture: graceful degradation under partial modality availability (Section 6.3); purpose-bound memory [101] enforcing retention at the memory layer; and right-to-erasure-aware long-term memory [13] supporting targeted deletion across embedding stores, RAG indices, and prompt caches (Section 8.1.1). Current memory modules prioritize performance, not governance.

R-5: Sim-to-real bridging and constrained action for response automation Response Automation is the integration frontier where compliance, not reasoning capability, sets the autonomy ceiling (Section 6.5). Three engineering directions: constrained-action frameworks integrating per-session least-privilege tokens, signed manifests, and tamper-evident logging, addressing [fm:A.5.3]A.5.3, [fm:S.7.2]S.7.2, [fm:A.5.2]A.5.2, and [fm:S.2.4]S.2.4; adaptive playbook learning updating response logic from observed attacker behavior within human-approved boundaries; and sim-to-real bridging methodologies transferring RL policies to production while preserving recovery-cost guarantees.

R-6: End-to-end pipeline integration and loop-closing The CTI pipeline (Section 6.4) and Investigation-to-Detection loop (Section 6.3) share a structural property: each stage’s input-quality assumptions go unvalidated, and feedback artifacts ([task:T-11]T-11 rule refinement) are not first-class outputs. Two directions: end-to-end pipeline integration with inter-stage quality controls, and closed-loop pipelines that route investigation findings into SIEM rule updates rather than burdening analysts. Alert Triage (Section 6.2) exhibits the same gap.

9.3. Governance and Standardization

Two governance directions translate deployable systems into accountable, regulated infrastructure: multi-agent attribution and audit standards, and sector-specific compliance and fairness frameworks.

R-7: Multi-agent attribution and audit standards Auditability asymmetry compounds in MAS where action lineage spans unlogged invocations. Section 8.1.3 identified multi-agent attribution standards [107] and cryptographically-signed action logs [24] satisfying SOC 2 CC7.2 and ISO 27001 A.8.15 requirements. The gap is not in capability but in standards that translate these requirements into agentic protocols, including extensions to MCP, A2A, or ACP [30] for cross-vendor attribution and delegation beyond OAuth 2.0. EU AI Act Art. 14 mandates oversight, which requires attribution; which is currently best-effort and require coordination across research, standards bodies, and regulators.

R-8: Sector overlays, fairness frameworks, and bias assessments for cybersecurity AI Three governance gaps lack established research traditions in cybersecurity: sector-specific compliance overlays translating HIPAA, PCI-DSS, and SOX into agentic implementation patterns, where vendor claims (Section 7) cite frameworks without demonstrating agentic-specific risk treatment; cybersecurity-specific fairness metrics [10,81] adapting disparate-impact analysis to security outcomes, recasting the open-source–proprietary gap (Section 6.1) as a fairness concern; and pre-deployment bias impact assessment templates aligned with EU AI Act Art. 9 and NIST AI RMF GOVERN-1.4 for cybersecurity-domain systems. Without these, deployable systems remain unassessable against nominally applicable standards.

10. Conclusion

This survey developed four analytical artifacts to characterize where agentic AI can close the SOC data-throughput gap: a taxonomy of 72 failure modes across 18 sub-categories along three causal axes; a decomposition of defensive cybersecurity operations into 13 tasks classified by autonomy level, oversight regime, and failure exposure; a literature-and-industry review of 22 research systems and 10 commercial offerings across five operational categories; and a compliance catalogue of 20 governance gaps mapped to GDPR, EU AI Act, NIST AI RMF, ISO 42001, and sector-specific frameworks. The central thesis these support is that the autonomy ceiling for cybersecurity AI is bounded asymmetrically, not by reasoning capability, which is sufficient for most surveyed tasks, but by action irreversibility, mitigation maturity, and compliance envelope. The risk to guard against is agent bloat: capability claims outpacing independent validation, benchmark accuracy mistaken for operational performance, and compliance posture asserted rather than demonstrated. Closing this gap requires coordinated methodological, engineering, and governance work across research, industry, and standards bodies. With the foundations laid and the agenda enumerated, agentic AI can advance from today’s vendor-bounded copilot toward a trusted, accountable, cross-organizational cyberdefense infrastructure where capability is delivered rather than merely claimed.