Preprints.org logo
Preprint
Article

This version is not peer-reviewed.

Artificial Intelligence as the Nervous System of Cyberspace: A Conceptual Model of Agentic Centrality and the Reflexivity of Cybersecurity

Submitted:

29 August 2026

Posted:

31 August 2026

You are already at the latest version

Abstract
This article models agentic AI as the emerging integrative layer of cyberspace's pre-existing sensing-and-control infrastructure, grounded in betweenness centrality and the attack–defense speed asymmetry. Situated against cybernetics, autonomic computing, and artificial immune systems, it argues that cybersecurity is reflexive because agent, medium, and protected object share one level of abstraction. The centrality hypothesis is made operationally explicit through a graph-theoretic illustration — a hybrid pre-agentic/agentic security-operations graph in which betweenness centrality is tracked as a function of increasing delegation to the agentic layer — and the operational boundary between agentic AI and earlier autonomic-computing systems is made explicit.
Keywords: 
agentic artificial intelligence
;  
cybersecurity
;  
cyberspace
;  
digital nervous system
;  
reflexivity
;  
security governance
;  
self-protecting systems
;  
betweenness centrality
Subject: 
Computer Science and Mathematics  -   Artificial Intelligence and Machine Learning

I. Introduction

Contemporary cyberspace is made up of layers that, in isolation, are static: network architecture, written policies, configured credentials, defined segmentations. These layers describe a structure but do not operate it. What gives this ensemble the capacity to detect, react, and adapt in real time is the growing presence of agentic artificial intelligence — systems that continuously observe the state of the digital environment, correlate dispersed signals, and trigger corrective actions before, during, and after events, expected or not.
This article argues that this function is best understood through the metaphor of the nervous system: just as an organism’s nervous system, by means of the body, senses internal and external stimuli and coordinates muscular, hormonal, and reflexive responses without itself being the skeleton or the organs, agentic AI increasingly runs through the more automated portions of cyberspace, senses their state — patch deployment, authentication, device behavior, network traffic — and coordinates responses in real time, without itself being the architecture or the policy that constitutes the structure upon which it acts. This nervous function, it should be stressed from the outset, did not begin with agentic AI: telemetry collection, signature-based detection, and rule-based remediation — implemented for over two decades by intrusion detection systems, SIEM platforms, and SOAR tools — already performed a more rudimentary version of the same sense-and-respond loop, comparable to a spinal reflex arc that operates reliably against anticipated stimuli but without contextual interpretation of the unanticipated. What agentic AI contributes, and what motivates the centrality argued for here, is not the loop itself but a more contextual, adaptive layer of integration overlaid on that pre-existing infrastructure.
Agentic AI is becoming structurally central within these increasingly automated cyber environments precisely because it fulfills this integrative role: it is the layer that makes them sensitive to their own state and capable of contextually reacting to the unexpected, in a way fixed rule-based automation alone does not. Cybersecurity, in this framework, is not a separate domain that has come to incorporate AI — it is one of the regulatory functions this nervous system continuously performs over the very environment it runs through, analogous to the immune function integrated and modulated by the nervous system in a biological organism.
The contribution of this article is a conceptual model for interpreting the position of agentic AI in the self-regulation of the increasingly automated portions of cyberspace, and the reflexive singularity of cybersecurity within this system. The work articulates the nervous system metaphor with foundations from cybernetics, graph theory, and the philosophy of information, distinguishing the locus of instantiation of AI from its domain of effect and characterizing cybersecurity as a reflexive function exercised over the informational environment itself. Because several elements of this synthesis — feedback control, autonomic self-protection, biologically inspired defense, and agentic security research — already have established lineages, Section II situates the model against this prior literature before the model is developed, so its claim to novelty rests on the resulting synthesis rather than on any single component. Two further concerns guide the article’s structure throughout: the centrality thesis of Section IV is not left as a bare metaphorical claim but operationalized, and the boundary separating “agentic AI” from earlier autonomic and rule-based automation is made explicit rather than left to intuition. Section IV-C and Section II-B address these points directly.

III. AI as the Nervous System of Cyberspace

A biological nervous system performs three interconnected functions: sensing, integrating (correlating signals into a coherent state), and responding (coordinating motor, hormonal, or reflexive action). This triad corresponds to what classical cybernetics describes as a feedback loop: a system that continuously adjusts its action based on the difference between observed and desired state [1]. Wiener established this structure decades before cyberspace and agentic AI existed, and cyberspace itself already instantiated rudimentary versions of the loop through intrusion detection, SIEM correlation, and SOAR-driven remediation — much as a spinal reflex arc senses, integrates, and responds to anticipated stimuli fast and reliably, but without the contextual interpretation a cortex supplies for stimuli it was not wired to recognize. This article’s original contribution is not the discovery of this loop, which long predates agentic AI, but the claim that agentic AI constitutes a qualitatively different layer overlaid on it, in the sense of the four criteria of Section II-B: an integrative layer capable of contextual judgment, flexible tool use, and decision under uncertainty, comparable to the role a cortex plays in modulating reflex arcs that already operate independently of it — with cybersecurity as this layer’s strictest reflexive function. The sensory function corresponds to continuous telemetry — logs, authentication events, network traffic, process behavior — much of which pre-agentic tooling already collects. The integrative function corresponds to correlating these signals into a coherent state picture beyond fixed rules, appearing in security operations as contextual alert aggregation and case prioritization. The responsive function corresponds to corrective action extending beyond pre-authored playbooks, such as host isolation, credential revocation, or situationally shaped adjustment of a detection rule.
This centrality is agentic in the precise sense that AI acts upon the environment it senses, closing the sense–decide–act loop without depending, at every iteration, on direct human intervention — much as nervous reflexes operate before and independently of conscious deliberation, even while remaining subject to it in larger-scale decisions. This approximates the paradigm of autonomic computing [2], later formalized in MAPE-K [3], but differs by proposing that agentic AI constitutes a cross-cutting layer of sensing, integration, and response for the increasingly automated portions of cyberspace, rather than for specific computational components or cyberspace as an undifferentiated whole — a layer whose most reflexive expression occurs in cybersecurity.
It is this nervous centrality — continuous, distributed, and present in a growing share of relevant interactions within highly automated segments of the digital environment — that justifies treating agentic AI as a structurally central integrative layer, rather than merely one more tool applied to them. An organism can be described by its skeleton and organs, but it is the nervous system — reflex arcs and cortex together — that makes it alert and reactive rather than merely a static structure. Likewise, the increasingly automated portions of cyberspace can be described by their architecture, data, and policies, but it is the agentic AI layer, overlaid on the reflex-like infrastructure described above, that makes them progressively more sensitive and contextually reactive to the unexpected — an emerging structural role, not a claim that cyberspace as a whole has already become such an environment.

IV. Foundations of Centrality: Network Topology and the Speed Mismatch

The preceding section established the centrality of agentic AI by metaphor. A metaphor illustrates but does not demonstrate centrality. This section proposes two foundations independent of the metaphor — one structural, one temporal — and closes with a toy quantitative illustration of the structural argument.

A. Topological Centrality

Centrality has a formal definition in graph theory, unrelated to biological analogy. Two metrics are relevant: degree centrality, measuring direct connections, and betweenness centrality, measuring how many shortest paths between other node-pairs a given node lies on [10]. A node with high betweenness is not necessarily the most powerful or connected node — it is the one through which most relevant communication among other parts of the system must pass, and networks organized around such hub nodes are known to be disproportionately vulnerable to the targeted removal of exactly those nodes, even when they tolerate the loss of ordinary peripheral nodes well [16].
If an organization’s cyberspace is modeled as a graph whose nodes are architecture, policies, identities, data, processes, and human operators — with an edge drawn between two nodes whenever an action taken with respect to one routinely depends on information about the state of the other — the agentic AI layer today occupies, in a growing number of highly automated environments, the position of high betweenness centrality in that graph: it is the layer that correlates identity telemetry with network telemetry, that connects a written policy to an observed event, that links a device’s behavior to a credential’s reputation. This is formulated here as an empirically testable hypothesis rather than a demonstrated result: the article does not map an actual security-operations graph or compute the betweenness centrality of its AI layer relative to the other nodes on real organizational data, and it should not be read as claiming to have done so. What can be stated with more confidence is the direction of the trend — that as more of the correlation work between telemetry sources is delegated to agentic processing, the betweenness centrality attributable to that layer should rise, and its removal should disproportionately disconnect otherwise-related parts of the graph — while the precise magnitude, the boundary of what should count as a node or an edge, and the environments in which the hypothesis holds remain open empirical questions, not settled ones. Section IV-C below makes the mechanism concrete with a toy example, rather than resolving the empirical question on real data.

B. The Speed Mismatch

A second, temporal foundation stems from an objective asymmetry between attack speed and human response speed. Threat intelligence reports document the continuous reduction of breakout time — the interval between initial compromise and the onset of lateral movement: the global average fell from 98 minutes in 2021 to 48 minutes in 2024 and 29 minutes in 2025, with the fastest recorded case at 27 seconds and, in one incident, exfiltration beginning four minutes after initial access [11]. A response window measured in seconds or minutes is structurally below what a human team can consistently sustain — an objective constraint of cognitive latency and coordination, not of training. Speed alone, however, does not single out agentic AI specifically: deterministic rules and pre-authored automation can also execute in sub-minute windows, and much current fast-response automation is non-agentic — a lineage whose most visible early demonstration was DARPA’s Cyber Grand Challenge, in which fully automated systems detected, exploited, and patched software vulnerabilities against one another without human intervention, at machine speed and scale, years before “agentic AI” became the operative label [17]. What the speed mismatch alone does not supply, and what motivates treating agentic AI as central, is the variability of contemporary attacks: adversaries combine techniques and exploit context-dependent misconfigurations a fixed rule set does not anticipate, so an adequate response must also be capable of contextual interpretation and decision under uncertainty — properties associated with criterion (iv) of Section II-B. The centrality of agentic AI thus follows from the conjunction of two constraints: defense must operate on attack’s temporal order of magnitude, and the attack surface must be heterogeneous enough that fixed rules cannot cover it; systems capable of both machine-speed execution and contextual judgment are therefore especially well positioned to close that loop. The argument remains falsifiable: it would lose its footing if attack speed did not outpace human response, or if fixed automation proved sufficient — which, in current data, is not the case.

C. A Parametric Illustration: Delegation and Centrality

Section IV-A states a hypothesis about how betweenness centrality should behave as correlation work is delegated to an agentic layer, without constructing a graph or computing a value. A naïve construction of this illustration would build a single pre-agentic graph and a single “fully agentic” graph in which the agentic node absorbs every legacy correlation rule — guaranteeing a star topology, and therefore guaranteeing high betweenness for the hub largely by definition. This subsection avoids that by using a hybrid, parametric construction instead: legacy rule-based edges are retained at every level of delegation, consistent with this article’s repeated claim that agentic AI is an emerging layer overlaid on pre-existing infrastructure rather than a replacement for it, and the agentic node’s centrality is observed to rise — or not — as a function of how much cross-domain correlation is additionally delegated to it, rather than assumed by construction.
Consider the same six structural nodes as Section IV-A — Architecture, Policy, Identity, Data, Process, Human Operators — connected by five legacy, rule-based edges that persist throughout: an EDR rule ties Identity to Process, a DLP rule ties Process to Data, a NAC rule ties Architecture to Identity, a segmentation rule ties Architecture to Data, and a governance rule ties Policy to Human Operators. These edges are never removed as delegation increases.
Let α ∈ [0, 1] denote the proportion of cross-domain correlation delegated to the agentic layer, operationalized as the fraction of the six structural nodes to which the agentic node is additionally connected, added one at a time in an order reflecting typical automation maturity — identity and data correlation first (commonly automated via UEBA and DLP integration), then process and architecture telemetry, then policy-to-event correlation, and finally human-operator behavioral correlation, automated last. Figure 1 shows the two endpoints of this sweep: α = 0 (agentic node isolated) and α = 1 (all six AI edges present alongside the five legacy edges).
Table 1 reports the normalized betweenness centrality of the agentic node, computed with Freeman’s shortest-path definition [10], at each of the seven discrete delegation levels obtained by adding one AI edge at a time, together with the specific edge added at each step so the sequence is reproducible without inference from the prose alone.
Figure 2 plots this trajectory. The result is monotonically non-decreasing — consistent with the directional claim of Section IV-A — but not smooth: CB(Agentic AI) stays near zero while the agentic node’s edges reach only nodes within the already-connected legacy cluster {Architecture, Identity, Data, Process}, where redundant legacy paths mean the agentic node is rarely the only route between two other nodes. The sharp increase between k = 4 and k = 5 occurs when the agentic node acquires an edge to Policy, becoming the sole bridge between that cluster and the separate {Policy, Human Operators} cluster; from that point on, every shortest path between the two clusters must pass through it. The final edge, to Human Operators, adds no further centrality at all (CB stays at 0.578 from k = 5 to k = 6): once the bridge exists, connecting a node that is already reachable through it does not create new shortest paths that must pass through the agentic node. This is more informative than a smooth curve would have been: betweenness accrues specifically from which structural boundary a new edge crosses, not from the count of edges delegated — exactly the structural role Section IV-A attributes to the agentic layer, now visible as a mechanism rather than assumed as an outcome.
Removal analysis. Section VIII argues that high betweenness centrality is what makes compromise of the agentic layer structurally different from the compromise of a peripheral component. Because legacy edges are retained at α = 1, removing the agentic node no longer disconnects the graph as severely as in the naïve construction: the two legacy clusters — {Architecture, Identity, Data, Process} and {Policy, Human Operators} — remain internally connected on their own rule-based edges. What is lost is the bridge between them: of 15 possible pairs of structural nodes, 8 involve one node from each cluster and become unreachable once the agentic node is removed, while the remaining 7 internal pairs stay connected through legacy automation alone. Figure 3 shows the graph before and after removal.
This hybrid result is a more precise second-order-reflexivity finding than a near-total disconnection would have been: it shows that the risk of compromising the agentic layer is concentrated exactly in the cross-domain correlations that only the agentic layer performs, while correlation work legacy automation already handled continues to function. That distinction — between what fails and what survives when the hub is removed — is more useful to a defender than a single aggregate disconnection figure, since it identifies which functions specifically depend on the agentic layer’s continued integrity.
Two caveats remain. First, the delegation order chosen — identity and data first, human-operator correlation last — reflects one plausible reading of automation maturity; a different order would shift where along the α axis the sharp increase occurs, not the qualitative pattern that bridging drives the largest gains. Second, this remains a small, six-node illustration offered to make the mechanism inspectable, not a measurement of any real topology; the empirical test proposed in Section IV-A remains the work required to establish this effect’s magnitude outside a toy model.
The two foundations of this section — topological centrality, now illustrated as a trajectory rather than assumed as an endpoint, and the speed-and-variability mismatch — independently support the centrality thesis. The nervous system metaphor should be read in light of these foundations as an organizing illustration, not the sole basis of the argument.

V. Where AI Exists and Where It Acts: Locus of Instantiation and Domain of Effect

To understand why cybersecurity occupies a particular position among the functions of this digital nervous system, it is useful to distinguish the locus of instantiation of any AI action — the space in which the computational process resides and decides — from its domain of effect — the space upon which the decision produces consequences. Even when AI triggers a physical effector, the decision-making occurs entirely within an informational space instantiated by physical components. The digital nervous system therefore always exists in cyberspace; what varies is where it projects its effects — and this variation functionally distinguishes cybersecurity from the other tasks this same agentic layer performs.
In logistics, the system senses routes, deadlines, and vehicle locations and responds by adjusting routes — but the object of its action is physical: a truck, a container, goods in transit. In healthcare, it senses vital signs and records and responds by alerting teams — but the object is the patient’s body. In energy, it senses consumption and grid load and responds by balancing electrical flow — but the object is physical infrastructure. Table 2 summarizes this pattern before the underlying distinction is developed.
This coincidence can be situated more precisely by drawing on two conceptual instruments from Floridi’s philosophy of information [9]: the notion of the infosphere — the informational environment constituted by the totality of entities, processes, and relations of an informational nature, including the very agents that operate within it — and the method of levels of abstraction, whereby a system is analyzed on the basis of a defined set of observables pertinent to that level, rather than its ultimate physical substrate. Under this lens, what distinguishes cybersecurity from the other functions of the digital nervous system is not an accidental coincidence of means, but the fact that the agent, the process, and the protected object — the AI layer, the telemetry it processes, and the network, identity, or data it protects — belong to the same level of abstraction within the infosphere. In logistics, healthcare, and energy, the agent likewise operates within the infosphere, but its domain of effect — the cargo, the body, the electrical grid — is accessible to it only through an informational representation; the object itself, at the level of abstraction relevant to the action, lies outside the infosphere. In cybersecurity, this mediation disappears: the protected object is itself, natively, an informational entity, at the same level of abstraction at which the agent exists and decides — not a representation of something residing at another level. It is this coincidence of level of abstraction, rather than a generic coincidence of informational nature, that more rigorously grounds the thesis of reflexivity proposed in this article.
One caveat: even in cybersecurity, the domain of effect can extend beyond cyberspace — e.g., isolating a compromised hospital host affects a medical team’s physical access to records. What remains reflexive is the primary object of protection — the integrity, confidentiality, and availability of cyberspace itself — even when consequences propagate beyond it, as can also occur, to a lesser degree, in the other functions of the digital nervous system.
This caveat becomes structural, rather than merely residual, in operational technology (OT) environments and cyber-physical systems — industrial controllers, SCADA, and domain-specific protocols, whose distinct security requirements are already recognized in dedicated guidance [18]. There, the object of the security action does not merely produce an eventual physical consequence: it constitutes, in real time, the physical behavior of the process itself. Isolating an industrial network segment is a single occurrence observed in two vocabularies. OT cybersecurity thus occupies an intermediate position between the reflexivity described here and the non-reflexive functions of a digital nervous system.

VI. Cybersecurity as a Reflexive Function of the Nervous System

Among the many tasks this digital nervous system performs — logistics optimization, health monitoring, energy balancing — cybersecurity occupies a particular position: it is the function through which the nervous system protects the very tissue of which it is a constitutive part, rather than a physical object external to it. A biological immune system is coordinated by the nervous system and acts upon the very body that sustains it; analogously, the cybersecurity function exercised by AI acts upon the very portion of cyberspace that instantiates and sustains it. As noted in Section II-C, this immunological framing has an established lineage of its own; what this article adds is placing that immune function as one activity coordinated by a broader nervous layer, rather than as a free-standing analogy for security as a whole. The immune analogy is illustrative rather than foundational: the more defensible claim is the level-of-abstraction argument of Section V — that agent, medium, and protected object coincide at the same level of abstraction — of which the immune analogy is one illustration among several.
This is a reflexive function in the precise sense established in the previous section: the agent, the medium in which it operates, and the object it protects sit at the same level of abstraction within the infosphere — not because they share a generic substrate, but because none of them needs to be represented from a distinct level of abstraction for the other to act upon it. As discussed in Section V, this coincidence is typical but not universal — the intermediate case of OT environments is accommodated by the definition of reflexivity proposed here as a limiting case, not as an exception that invalidates it. When an AI agent detects a ransomware attempt, correlates indicators of compromise, and isolates a compromised host, it is exercising, over the portion of cyberspace it operates within, a function equivalent to the immune response coordinated by a nervous system over a body — with the particularity that, in the digital case, the protected body and the agent that protects it are observable within the same level of abstraction, rather than merely being implemented on the same type of hardware.
A security policy, in this framework, specifies a desired state that remains operationally inert until monitoring and enforcement mechanisms instantiate it — what contemporary governance frameworks formalize as the functions of governing, identifying, protecting, detecting, responding, and recovering [12]. A mandatory MFA policy, a network segmentation rule, or a documented set of detections produce real effect only when the agentic nervous system senses them, verifies their enforcement, and reacts to violations in real time — checking whether each connection actually uses MFA, whether each device is in fact authorized, whether each traffic pattern is in fact expected.

VII. Concrete Manifestations: Sensing, Integration, and Response

The practice of detection as code (DaC) illustrates the integrative and responsive function of the digital nervous system in cybersecurity: detection logic — what must be sensed and how it should be interpreted — is written, versioned, and tested with the same software engineering rigor used to build the very environment it protects, allowing this logic to evolve alongside the digital organism it monitors, without losing traceability or governance. Until recently, this practice still relied on a human detection engineer to translate threat intelligence into rule syntax; what has changed by 2026 is that the authoring step itself has begun to move inside the agentic layer. Recent industrial research describes AI-assisted detection-authoring pipelines in which an agent drafts, tests, and iterates candidate detection logic directly inside the developer environment, under explicit quality, cost, and latency trade-offs, rather than merely executing rules a human has already written [15]. In the terms of this article, this is not a peripheral tooling improvement: it is the sensory-integrative function of the nervous system beginning to author its own stimulus vocabulary, which is precisely the kind of development the second-order reflexivity discussed in Section VIII anticipates — the agentic layer does not only consume the rules that define what counts as a threat, but increasingly writes them, which raises the provenance of AI-generated detection logic itself to a governance concern.
AI SOC (AI-assisted Security Operations Center) architectures illustrate the sense–integrate–respond cycle at scale: telemetry from multiple sources is continuously correlated, higher-risk cases are automatically prioritized, and corrective actions — from adjusting a detection rule to isolating a host — are proposed or executed by agents, with audit trails and human review preserved for higher-impact decisions (ChatOps). This architecture reproduces, at digital scale, the division between automatic reflex and conscious deliberation observed in biological nervous systems, matching the trajectory documented in the agentic-AI-in-cybersecurity literature cited in Section II-D, which traces SOC assistants moving from alert summarization toward semi-autonomous triage and response pipelines coordinated across specialized agents [6], and sector-level accounts of agentic systems taking an increasingly operational role in cyber-threat management [8]. Read together with the DaC development above, the same agentic layer that senses and correlates telemetry is beginning to also author the rules that define what is worth sensing, tightening — rather than loosening — the sense–integrate–respond loop of Section III.
The mapping of attack techniques onto frameworks such as MITRE ATT&CK [13] functions, in this analogy, as a repertoire of stimulus patterns recognized by the nervous system — a shared vocabulary that allows the agentic layer to quickly identify what type of threat is underway and coordinate the corresponding response, much as a nervous system recognizes patterns of pain, temperature, or pressure to trigger appropriate reflexes.

VIII. Second-Order Reflexivity: Who Protects the Nervous System?

The model developed in Sections III through VII treats agentic AI as a layer that protects the portions of cyberspace it operates within. Recent agentic-security literature makes clear that this framing is incomplete on its own terms: the agentic layer is not only a protector but also, increasingly, a target [7]. Documented risk categories specific to agentic systems — as opposed to conventional software — include indirect prompt injection, in which instructions embedded in processed content redirect an agent’s behavior; memory or context poisoning, in which persisted state is corrupted to bias future decisions; tool or credential compromise, in which the agent’s access to external systems is hijacked rather than the agent’s reasoning itself; privilege escalation performed through the agent’s own authorized actions; and specification gaming or goal misalignment, in which the agent pursues a literal reading of an objective that diverges from the intended one, without any adversarial input at all. NIST has treated these as a distinct risk category from traditional software vulnerabilities, soliciting public input on how to measure and constrain agent security given these failure modes [14], alongside NIST’s broader, voluntary framework for AI trustworthiness [21]. Practitioner taxonomies formalize this same risk surface: OWASP’s agentic security guidance enumerates threat categories spanning planning, tool use, identity, memory, and inter-agent communication [22,23], and MITRE maintains a living knowledge base of adversarial tactics against AI-enabled systems, modeled after the MITRE ATT&CK framework already invoked in Section VII [24].
Within the nervous system metaphor, this produces a second-order reflexivity the model must accommodate: agentic AI protects the portions of cyberspace it inhabits, and that same environment — including the telemetry, tools, and memory the agentic layer depends on — must in turn protect the agentic layer that protects it. Biologically, a nervous system depends on a blood–brain barrier and immune-privilege mechanisms that protect neural tissue from the very immune activity it coordinates elsewhere, precisely because damage to the coordinating layer degrades every function it regulates. The digital analogue is structural: if the agentic layer occupies the high-betweenness position argued in Section IV-A and made concrete in Section IV-C, a compromise does not merely remove one node — it corrupts specifically the cross-domain correlation function that depends on it, a materially different failure mode from a peripheral compromise. As the toy graph illustrates directly, removing the fully delegated agentic node does not destroy the network wholesale — legacy, rule-based connectivity survives within each cluster — but it does eliminate every one of the eight cross-cluster structural-node pairs that only the agentic layer connected, precisely the correlations this article has argued are the agentic layer’s distinctive contribution.
This second-order reflexivity does not weaken the centrality thesis; it sharpens it. Precisely because the agentic layer is structurally central, its own integrity — tool provenance, memory isolation, telemetry authenticity, and the boundaries of its authorized actions — becomes a first-order security concern rather than a secondary implementation detail. A model that describes agentic AI purely as protector, without acknowledging it is simultaneously an attack surface, would misrepresent the very system it explains. This article does not resolve how that second-order protection should be architected — properly the subject of the agent-security literature cited above — but identifies it as a structural consequence of the model and a concrete avenue for the future work of Section X.

IX. Limits of the Metaphor

The nervous system metaphor has limits that must be acknowledged so that its analytical usefulness is not overstated. First, a biological nervous system is singular and integrated by evolutionary design; cyberspace today is sensed by a multiplicity of distinct AI agents, often from different vendors, with no guarantee of full integration among them — which makes the current scenario resemble a set of partial, overlapping nervous systems more than a single, centralized nervous system, a fragmentation that, as noted in Section IV-C, would in practice distribute rather than eliminate the aggregate betweenness centrality attributed to a single hub in the toy calculation. Second, the constitutive authority over security policy — the definition of what should be protected and why — remains of human, legal, and institutional origin; the agentic nervous system executes and reacts, but does not decide, in the normative sense, what constitutes a threat or a value worth protecting. Third, parts of cybersecurity involve the protection of physical components (hardware, data centers, chip supply chains) whose compromise is not entirely sensable by the agentic layer, requiring complementary physical controls that operate outside the nervous analogy. Fourth, the intermediate position occupied by cybersecurity in operational technology environments, discussed in Section V, requires a refinement of the nervous system metaphor that this article does not yet develop.
A fifth limit concerns the vocabulary of the metaphor itself. Expressions such as “living organism,” “sensitive to itself,” and “nervous reflex” are analytically useful but can, if left unqualified, suggest unity of purpose, integration, or even consciousness that the model does not claim and that the fragmentation described in the first limit above directly contradicts. It is therefore worth distinguishing explicitly between operational reflexivity — the coincidence of agent, medium, and object at the same level of abstraction, as defined in Section V, which is the only claim this article makes — and stronger notions such as self-awareness, intentionality, or normative agency, which the model neither requires nor implies.
A sixth limit concerns scope, and governs every claim in the preceding sections: the centrality argued for is best supported within highly automated, telemetry-rich environments — security operations centers, cloud-native infrastructure — and is not a claim that agentic AI already senses and responds across cyberspace as an undifferentiated whole. Large portions of contemporary digital infrastructure — DNS, BGP routing, PKI, TLS negotiation, embedded devices, legacy applications, many industrial protocols — continue to operate primarily through non-agentic mechanisms, some reliably for decades without any AI layer. The trajectory described is an emerging structural role within the more automated segments of cyberspace, overlaid on pre-existing reflex-like infrastructure, not a completed architecture spanning cyberspace in its entirety.

X. Conclusions

This article proposed that the emerging centrality of agentic AI within the increasingly automated portions of cyberspace is well described by the nervous system metaphor — not because agentic AI introduces the sense–integrate–respond loop, already implemented in reflex-like form by pre-agentic infrastructure, but because it constitutes the more contextual, integrative layer a mature nervous system requires beyond fixed reflex arcs (Section III), made operationally precise by the four criteria of Section II-B. Section II situated this proposal against five prior lineages, arguing that the article’s sharpest claim is not the generic proposition that AI resembles a nervous system, but the specific combination of agentic centrality, the coincidence of level of abstraction among agent, medium, and object, the resulting reflexivity of cybersecurity, and the second-order reflexivity of protecting the protecting layer itself.
Cybersecurity emerges, in this framework, as the reflexive function of this nervous system, grounded in the level-of-abstraction argument of Section V rather than the immune analogy alone, which Section VI treats as illustrative rather than equivalent. Section VIII extended the model to the second-order reflexivity the agentic-security literature makes unavoidable: the layer that integrates and responds within these automated portions of cyberspace must itself be protected, and its growing centrality makes this a first-order concern. Section IV-C showed on a hybrid toy graph that this is not merely rhetorical: as delegation to the agentic layer increases, its betweenness centrality is non-decreasing in the toy construction, rising sharply only once the layer bridges previously separate clusters of legacy automation — and removing it at full delegation eliminates specifically the cross-domain connectivity that only the agentic layer supplied.
This formulation holds that agentic AI is not merely one more tool used by cybersecurity, but an increasingly central integrative layer that makes the automated portions of cyberspace more sensitive and contextually reactive to the unexpected than their pre-agentic, reflex-like infrastructure alone would allow — without losing sight of the fact that the normative legitimacy of protection remains anchored in human and institutional decisions external to the agentic layer, that large parts of contemporary digital infrastructure continue to operate without it, as stressed in Section IX, and without overstating what “sensitive” and “reactive” are meant to claim.
Future work could pursue three concrete directions: first, the empirical test, proposed as a hypothesis in Section IV-A and illustrated only in miniature in Section IV-C, of measuring betweenness centrality on an actual security-operations graph with an explicit, organization-specific definition of nodes, edges, and delegation order; second, modeling the integration or fragmentation of multiple AI agents as partially connected neural networks, and examining how coordination failures among them resemble neurological dysfunctions in biological organisms; and third, the architectural question raised in Section VIII of how the second-order protection of the agentic layer itself should be designed. The main contribution of this work is a conceptual model, explicitly positioned against its antecedents, explicit about its scope, and partially operationalized on a parametric toy graph, for understanding agentic AI as an emerging integrative layer within the self-regulation of the increasingly automated portions of cyberspace, and cybersecurity as its reflexive function.

References

  1. Wiener, N. Cybernetics: Or Control and Communication in the Animal and the Machine, 2nd ed.; MIT Press: Cambridge, MA, USA, 1961. [Google Scholar]
  2. Kephart, J. O.; Chess, D. M. The vision of autonomic computing. Computer 2003, 36, 41–50. [Google Scholar] [CrossRef]
  3. IBM Corporation, An Architectural Blueprint for Autonomic Computing, 4th ed.; IBM: Armonk, NY, USA, 2006.
  4. Forrest, S.; Hofmeyr, S. A.; Somayaji, A.; Longstaff, T. A. A sense of self for Unix processes. In Proc. IEEE Symp. Security and Privacy, 1996; pp. 120–128. [Google Scholar]
  5. Yuan, E.; Esfahani, N.; Malek, S. A systematic survey of self-protecting software systems. ACM Trans. Auton. Adapt. Syst. 2014, 8, 17. [Google Scholar] [CrossRef]
  6. Lazer, S. J.; Aryal, K.; Gupta, M.; Bertino, E. A survey of agentic AI and cybersecurity: Challenges, opportunities and use-case prototypes. arXiv 2026, arXiv:2601.05293. [Google Scholar]
  7. Chhabra, A.; Datta, S.; Nahin, S. K.; Mohapatra, P. Agentic AI security: Threats, defenses, evaluation, and open challenges. IEEE Access 2026, 14. [Google Scholar] [CrossRef]
  8. Kshetri, N.; Voas, J. Agentic artificial intelligence for cyber threat management. Computer 2025, 58, 86–90. [Google Scholar] [CrossRef]
  9. Floridi, L. The Philosophy of Information; Oxford Univ. Press: Oxford, U.K., 2011. [Google Scholar]
  10. Freeman, L. C. A set of measures of centrality based on betweenness. Sociometry 1977, 40, 35–41. [Google Scholar]
  11. CrowdStrike. 2026 Global Threat Report; CrowdStrike: Austin, TX, USA, 2026. [Google Scholar]
  12. National Institute of Standards and Technology (NIST). Cybersecurity Framework (CSF) 2.0; NIST: Gaithersburg, MD, USA, 2024. [Google Scholar]
  13. MITRE Corporation. MITRE ATT&CK framework. Available online: https://attack.mitre.org (accessed on 3 August 2026).
  14. National Institute of Standards and Technology (NIST), Center for AI Standards and Innovation (CAISI), “Request for information regarding security considerations for artificial intelligence agents,” Federal Register, Docket No. NIST-2025-0035, Jan. 2026.
  15. Bulut, F.; DePaolis, C.; Batta, R.; Mangal, A. AVDA: Autonomous vibe detection authoring for cybersecurity. Proc. ACM Joint Eur. Softw. Eng. Conf. Symp. Found. Softw. Eng. (ESEC/FSE Companion), 2026. [Google Scholar]
  16. Albert, R.; Jeong, H.; Barabási, A.-L. Error and attack tolerance of complex networks. Nature 2000, 406, 378–382. [Google Scholar] [CrossRef] [PubMed]
  17. Defense Advanced Research Projects Agency (DARPA). Cyber Grand Challenge. Available online: https://www.darpa.mil/research/programs/cyber-grand-challenge (accessed on 3 August 2026).
  18. Stouffer, K.; Pease, M.; Tang, C.; Zimmerman, T.; Pillitteri, V.; Lightman, S.; Hahn, A.; Saravia, S.; Sherule, A.; Thompson, M. Guide to Operational Technology (OT) Security; NIST Special Publication 800-82, Rev. 3; NIST: Gaithersburg, MD, USA, 2023. [Google Scholar] [CrossRef]
  19. Floridi, L. The Fourth Revolution: How the Infosphere Is Reshaping Human Reality; Oxford Univ. Press: Oxford, U.K., 2014. [Google Scholar]
  20. Floridi, L. The Ethics of Information; Oxford Univ. Press: Oxford, U.K., 2013. [Google Scholar]
  21. National Institute of Standards and Technology (NIST). Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1; NIST: Gaithersburg, MD, USA, 2023. [Google Scholar]
  22. OWASP Agentic Security Initiative, Agentic AI — Threats and Mitigations; OWASP Foundation, 2025.
  23. OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026; OWASP Foundation, 2025.
  24. MITRE Corporation. MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. Available online: https://atlas.mitre.org (accessed on 3 August 2026).

Author Biography

Luiz Fernando Moraes da Silva works at the Institutional Security Office of the Presidency of the Republic of Brazil, where his activities involve the governance and oversight of cybersecurity and digital-infrastructure matters within the federal public administration. His research interests include the conceptual and philosophical foundations of cybersecurity, the governance of agentic artificial intelligence, and the application of cybernetics and information theory to the analysis of digital environments. This article reflects his individual academic views and does not represent an official position of the institution with which he is affiliated.
Preprints 230730 g001
Figure 1. Toy hybrid graph at zero delegation (α = 0, legacy edges only) versus full delegation (α = 1, legacy edges retained and all six AI-mediated cross-domain edges added).
Figure 1. Toy hybrid graph at zero delegation (α = 0, legacy edges only) versus full delegation (α = 1, legacy edges retained and all six AI-mediated cross-domain edges added).
Preprints 230730 g001
Preprints 230730 g002
Figure 2. Betweenness centrality of the agentic node as a function of the delegation parameter α, showing a monotonically non-decreasing trajectory with a sharp increase once the agentic layer bridges the two legacy clusters.
Figure 2. Betweenness centrality of the agentic node as a function of the delegation parameter α, showing a monotonically non-decreasing trajectory with a sharp increase once the agentic layer bridges the two legacy clusters.
Preprints 230730 g002
Preprints 230730 g003
Figure 3. Effect of removing the agentic node at full delegation (α = 1): the two legacy clusters remain individually connected through rule-based edges, but the cross-cluster bridge — and the 8 of 15 structural-node pairs it uniquely connected — is lost.
Figure 3. Effect of removing the agentic node at full delegation (α = 1): the two legacy clusters remain individually connected through rule-based edges, but the cross-cluster bridge — and the 8 of 15 structural-node pairs it uniquely connected — is lost.
Preprints 230730 g003
Table 1. Betweenness centrality of the agentic node as a function of delegation.
Table 1. Betweenness centrality of the agentic node as a function of delegation.
k Edge added α = k/6 CB(Agentic AI)
0 — 0.000 0.000
1 AI–Identity 0.167 0.000
2 AI–Data 0.333 0.022
3 AI–Process 0.500 0.022
4 AI–Architecture 0.667 0.044
5 AI–Policy 0.833 0.578
6 AI–Human Operators 1.000 0.578
Table 2. Locus of instantiation and domain of effect across sectors.
Table 2. Locus of instantiation and domain of effect across sectors.
Domain Sensed signals Object of the action Same level?
Logistics routes, deadlines, vehicle location cargo, vehicles (physical) No — mediated
Healthcare vital signs, records, test results patient’s body (physical) No — mediated
Energy consumption, generation, grid load electrical infrastructure (physical) No — mediated
Cybersecurity telemetry, identity, network state networks, identities, data (informational) Yes — reflexive
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.
Copyright: This open access article is published under a Creative Commons CC BY 4.0 license, which permit the free download, distribution, and reuse, provided that the author and preprint are cited in any reuse.