Self-adapting AI agents foresee attacker moves in automated incident response

The AI Cyber-Defender That Rehearses Its Every Move Before Striking

In cybersecurity, the fastest answer is not always the safest one. A new artificial intelligence framework, published on 29 August 2026 as open-access research in Discover Artificial Intelligence, argues that the surest way for machines to fight hackers at machine speed is to pause—virtually—and imagine what could go wrong before touching a single firewall rule. The system, called CIPHER-A (Counterfactual Incident Response Planning with Hallucination-Aware Evaluation and Reasoning—Adaptive), was built by Sheetal Prasad Kizhakel and Sagar Dhanraj Pande to attack one of the most quietly dangerous habits of modern security automation: executing an AI-generated countermeasure without asking what it might do to the very network it is meant to protect. In trials spanning three public attack datasets and 143 simulated incidents, the framework cut the degradation of response plans under adaptive adversaries by 59.2 percent, drove falsely approved dangerous actions down to a 3.2 percent rate—compared with 22.7 percent for a conventional platform—and shortened mean containment time from 14.3 minutes to 8.9.

The machinery of automated incident response has long been built on playbooks. Security Orchestration, Automation and Response (SOAR) platforms—the industrial standard, exemplified by tools such as Palo Alto’s Cortex XSOAR, Splunk SOAR and IBM QRadar—operate by matching incoming alerts against pre-written decision trees drafted by human engineers. When attacks repeat the patterns those trees anticipate, the systems perform admirably. The trouble begins with advanced persistent threats, or APTs: multi-stage campaigns in which skilled intruders harvest credentials, move laterally between machines, escalate privileges and change tactics the moment a defense bites. Against such opponents, a playbook is a map of a battlefield that keeps rearranging itself. The authors frame the core failure bluntly: a response engine bound to pre-coded procedures can never generalize beyond the imagination of the engineer who wrote it, and modern attackers probe exactly that boundary, arming themselves with automated tooling while defenders remain locked inside procedures frozen long before the first packet arrived.

Large language models promised a way out. Over the past three years the industry has rushed LLM inference into the security operations center—Microsoft’s Security Copilot and Google’s Chronicle AI are prominent examples—so that response plans can be composed in real time from raw alert data rather than retrieved from static files. But as Kizhakel and Pande document through a systematic review of 25 recent papers, the new generation of tools inherits an old blind spot: they generate a plan once, when the alert arrives, then execute it step by step with no mechanism to re-evaluate the remaining actions as the situation evolves. The omission matters because attackers are watching too. Game-theoretic studies show that sophisticated adversaries actively monitor defensive activity and adjust, drawing on a documented repertoire of more than 190 attack techniques cataloged in the MITRE ATT&CK framework. In the researchers’ evaluation, the simulated red-team adversary showed how quickly adaptation unfolds: it switched to a backup command-and-control channel within 4.7 seconds of having its primary channel blocked.

CIPHER-A’s answer is a closed loop in which no action is taken on faith. The framework, orchestrated with the LangGraph engine and powered by two language models—Anthropic’s Claude 3 Sonnet for consequence reasoning and a locally hosted Mistral-7B for fast adversarial prediction—is organized around two core inventions. The first is the Counterfactual Validation Engine, or CVE, which the authors describe as the first pre-execution consequence-prediction mechanism for individual incident-response actions. Before any proposed action reaches a live system, the CVE compels the language model to generate three distinct outcome scenarios and commit to structured probability estimates for each, so that safety is judged before the move is made rather than discovered afterward. The second is the Attacker Simulation Agent, or ASA, which re-enters the loop after every executed step to forecast how the adversary will adapt and to force re-validation of everything the plan still intends to do. Together they close the gap between what a responder plans and what a live adversary allows.

The arithmetic behind that caution is explicit. For each candidate action, the engine computes a risk score: the sum, across the three imagined outcomes, of each outcome’s predicted probability multiplied by its harm. Harm is itself a weighted blend of three dimensions—severity, scored on the Common Vulnerability Scoring System scale; scope, the “blast radius” of other network resources the outcome would affect; and reversibility, where a fully reversible change counts for little and permanent damage counts for much. The weights, fixed at 0.50, 0.30 and 0.20, were tuned by minimizing the mismatch between predicted risk and the overrides human analysts actually made across 92 DARPA OPTC test incidents; severity earned the largest share because it proved the strongest predictor of analyst judgment. A composite score then folds in asset criticality and an urgency factor drawn from the active threat’s CVSS base score, calibrated by grid search to minimize the false safety rate. Two thresholds—0.35 and 0.65—sort every action into three fates: execute autonomously, modify into a safer variant, or escalate to a human. To keep the language model honest, its output is locked to a strict JSON schema with bounded outcome categories, a guard against hallucinated probabilities.

The second stage is where CIPHER-A departs most sharply from its predecessors. After each action executes through one of three live backends—the CrowdStrike Falcon API for endpoint isolation, AWS interfaces for privilege revocation and instance quarantine, and Microsoft Active Directory for account suspension—the Attacker Simulation Agent predicts the adversary’s next state. Crucially, those predictions are grounded: the ASA is constrained to the MITRE ATT&CK v14.1 knowledge base, a catalog of 14 tactics and more than 190 documented intrusion techniques, so the model can only forecast pivots that correspond to real-world tradecraft such as lateral movement, privilege escalation or persistence. Its output—new attacker position, pivot method with an ATT&CK identifier, predicted next target and a confidence level—flows back into the shared incident state, altering how every remaining step is judged. Alerts enter through a Wazuh 4.7 SIEM pipeline, and because dependency graphs of roughly 500 enterprise hosts would overflow even a 200,000-token context window, the CVE extracts a compact subgraph of the affected host and its nearest neighbors—typically four to eight machines. Every decision, score and state transition lands in a PostgreSQL audit ledger built for forensics.

To measure whether all this machinery actually matters, the authors introduce a metric they believe is the first of its kind: the Response Plan Degradation Rate, or RPDR. The measure captures the fraction of an initially approved plan’s actions that become too risky to execute as the attacker adapts—a number that stays at zero under the convenient fiction of a static opponent and climbs toward 100 percent when every remaining step must be regenerated from scratch. Because a metric computed by the same system it judges invites circularity, the researchers took an unusual extra step: they cross-referenced every action CIPHER-A flagged as degraded against the DARPA OPTC red team’s ground-truth execution logs, which record the attacker’s actual pivots independently of any defender. Of 143 cases analyzed, 97.2 percent of the flagged degradations coincided with a genuine, logged adversary maneuver—evidence, the authors argue, that the metric tracks real attacker adaptation rather than the system’s own misestimation of risk. In the live pipeline, the running RPDR also serves as a tripwire: if it climbs past 0.30 mid-incident, the framework automatically regenerates the remaining plan before carrying on.

The performance gaps were wide. Across 143 incidents drawn from three DARPA OPTC scenarios—lateral movement via credential harvesting and remote service exploitation, privilege escalation combined with staged data exfiltration, and a command-and-control intrusion ending in ransomware deployment, with the CTU-13 botnet corpus supplying additional data on network-blocking consequences—CIPHER-A held its mean RPDR to 15.6 percent, against 38.2 percent for its own static variant, which validates actions only once, 47.3 percent for a multi-agent LLM baseline and 34.7 percent for a hierarchical reinforcement-learning approach. Its false safety rate of 3.2 percent—the share of actions executed without human review that later had to be rolled back—compares with 22.7 percent for a rule-based SOAR baseline. Escalation decisions proved 91.7 percent accurate while touching a modest 8.3 percent of actions, and containment arrived 37.8 percent faster than under the conventional playbook system. Statistical significance was assessed with Wilcoxon signed-rank tests across incidents, and the computational price of the added vigilance was modest: an average of roughly 700 tokens of model input and output per validated action, served from a single NVIDIA A100 GPU server.

Some of the most telling results are almost microscopic in scale. In the ransomware scenario—where the adversary demonstrated its fastest adaptation, failing over to a backup command-and-control channel within 4.7 seconds of the primary channel being severed—the Attacker Simulation Agent anticipated that transition correctly in 81.3 percent of cases. Plotting degradation against the action sequence, the researchers found a sharp inflection at action four, the moment the adversary pivots: from that point on, plans validated statically diverge from reality, while the adaptive loop keeps re-scoring each remaining step against the attacker’s updated position. The residual 15.6 percent degradation concentrated in cases where ASA confidence fell below 0.7, the threshold the system requires before accepting a predicted attacker-state update—a deliberate design choice that errs on the side of skepticism. The pattern suggests a broader lesson: in contests against adaptive opponents, the value of a defense lies not in any single move but in how quickly the defender’s model of the enemy is refreshed.

The researchers are candid about the boundaries of the work. Performance figures for the two external adaptive baselines were not reported in their original publications; the authors derived them by applying CIPHER-A’s own scoring framework to those papers’ published indicators, and they flag the comparison as indicative rather than exactly equivalent. A concurrent 2026 framework called AgentSOC, which also applies counterfactual LLM reasoning to security operations, asks a different question—it models plausible attacker progressions rather than the downstream consequences of defender actions—and so far stops at dry-run testing on a synthetic 50-node topology without live execution connections. What CIPHER-A demonstrates, its authors argue, is something more fundamental than a leaderboard win: that pre-execution consequence reasoning and post-execution adversarial modeling are not optional refinements but the minimum price of admission for autonomous response against genuine advanced persistent threats. Human analysts, notably, remain embedded in the design, with just 8.3 percent of actions routed upward for review at 91.7 percent routing accuracy. In the authors’ framing, the future of cyber defense belongs not to the AI that answers fastest, but to the one that asks, before every move, what the enemy is about to do about it.