Large language models (LLMs) are used not only to generate text but also in systems that organize processing according to a given goal, call external tools, and choose the next step based on the results.

A system that incorporates an LLM into part of its judgment and processing and advances toward a goal by repeating multiple steps in this way is an LLM agent. In cybersecurity, applications such as organizing threat information, analyzing vulnerabilities, triaging alerts, and supporting incident response are being explored.

What Is an LLM Agent?

An ordinary LLM outputs text, code, or similar content in response to an input instruction. An LLM agent, by contrast, has an action loop in which it receives the surrounding situation, chooses a process in light of the tools available, and updates its state while observing the results of execution.

The action loop consists of obtaining the situation, choosing a process, executing a tool, observing the result, and updating the state. Its defining feature is that, rather than ending after a single output, it uses the results obtained for its next decision.

However, not every system that uses an LLM is an agent. If the LLM’s output is simply returned and is not connected to external processing or a subsequent decision, no iterative action loop is formed.

Components of an Agent

An LLM agent does not operate with the LLM alone; it operates by combining input information, available tools, processing state, memory, and execution results.

Table 1 Components of an LLM agent

Component	Role
Situation / input	Provides the information to be judged, such as logs, alerts, vulnerability information, and threat reports
LLM	Reads the input situation and chooses the next process or tool to use
Tools	Connect to security products, analysis functions, knowledge bases, and so on to perform queries and processing
State	Holds completed processes, results obtained, unfinished tasks, and so on
Memory / external knowledge	Retrieves past interactions, incident history, threat information, and so on as needed
Observations	Return tool execution results and changes in the environment to the next decision

In this configuration, the LLM does not need to hold all information internally. It can proceed by obtaining the necessary knowledge from outside and checking the results of tool execution.

Single-Agent and Multi-Agent Configurations

A configuration in which a single LLM agent proceeds while choosing tools is called a single-agent configuration. While it keeps the processing flow relatively simple, in long tasks a single agent must manage all of the preceding situation and decisions.

A configuration in which roles are divided among multiple agents is called a multi-agent configuration. Agents responsible for threat information, vulnerability analysis, incident response, and so on can be separated, and their results combined.

Multi-agent configurations include approaches in which a central agent breaks down work and assigns it, approaches in which processing results are passed along in sequence, and approaches in which multiple agents examine the same problem and reach a consensus.

Cases have been reported in which dividing roles among multiple agents and coordinating them improved performance compared with a single agent. On the other hand, more complex configurations do not always produce better results, and communication between agents, sharing of state, processing delays, and how to handle conflicting judgments must also be designed.

Use in Cyber Defense

LLM agents can read information in different formats and proceed while working with analysis functions and knowledge bases. This property can be used in cyber defense work, which handles large volumes of information and requires multiple checks.

Table 2 Areas of use for LLM agents in cyber defense

Area	Processing supported by agents
Threat intelligence	Extracts and organizes attack techniques, related identifiers, relationships, and so on from threat reports and vulnerability information
Vulnerability assessment	Examines code and vulnerability information and organizes problem areas and targets to check first
Secure software development	Receives results such as static analysis and generates explanations of problems and information for fixing them
Intrusion detection / monitoring	Classifies logs and alerts and supports selecting targets for investigation and adding related information
Incident response	Supports alert triage, organizing the situation, selecting response procedures, and creating records and reports
Phishing detection	Analyzes text, web pages, and so on and examines features related to deception
Compliance / risk assessment	Maps requirements to system information and organizes items to check

In these processes, it is important not only for the LLM to reach conclusions on its own, but also to have a configuration that obtains external analysis results and threat information and presents results together with the supporting information.

Memory and External Knowledge

The memory of an LLM agent includes short-term memory, which is held only during the current task, and long-term memory, which retains information after the task ends.

Short-term memory is used to hold the current conversation and the progress of processing. However, there is an upper limit to the amount of information it can handle, and in long processes earlier decisions and results may be lost.

Long-term memory stores threat information, past incidents, organization-specific knowledge, and so on, and retrieves them when needed. In configurations that use Retrieval-Augmented Generation (RAG), external information can be obtained and added to judgments without relying solely on what the LLM learned at training time.

On the other hand, using external information does not automatically make results accurate. It is necessary to check the quality of the information being searched, the relationships among pieces of information, how up to date they are, and whether the retrieved content has been correctly reflected in the results.

Incorporating Humans into the Process

In cyber defense, the process in which an agent creates a proposal must be separated from the process that actually makes changes to systems. In particular, for operations that change live systems, it is important not to let the agent finalize the process alone, but to require human approval.

In a design that incorporates humans into the process, it is necessary to define at least the types of decisions that require approval, how the agent hands over evidence and proposals, how humans can modify, stop, or escalate actions, and the records needed to review operations afterward.

Even with human involvement, merely approving the agent’s output as a formality is not enough. So that humans can make high-impact decisions, the information processed by the agent needs to be presented in a form that can be checked while taking cognitive load into account.

Technical Challenges of LLM Agents

LLM agents face the problem of hallucination, in which they plausibly generate content that is not factual. If nonexistent vulnerability information, incorrect attack paths, or inappropriate remedies enter the process, they can cause investigation priorities and responses to go wrong.

Furthermore, in agents, a single error is carried over into the next process. If the wrong tool is called at an early stage, the error may cascade into subsequent processes that rely on that result.

Prompt injection, in which instructions that change the agent’s behavior are embedded in text or data obtained from outside, is also a challenge. Because security investigations handle untrusted logs, web pages, documents, and so on, measures such as input sanitization, output filtering, and privilege separation for tool calls are necessary.

In addition, the information handled by agents may include confidential organizational information such as network configurations, authentication logs, vulnerability lists, and incident timelines. It is necessary to manage which information is passed to the LLM, where it is processed and stored, and which tools the agent is allowed to access.

The Gap Between Evaluation and Real-World Operation

In research on LLM agents, the models used, the tasks targeted, the evaluation data, and the criteria for success are not standardized. As a result, it is difficult to simply compare the results of different systems.

In research on LLM agents, performance is mainly evaluated in controlled experimental environments, and production-scale evaluation in real operational environments is limited.

Therefore, the fact that high performance was shown in experiments should be considered separately from whether a system can be safely introduced into actual security operations. In real-world operation, evaluation must cover not only processing accuracy but also error detection, processing time, operating privileges, records, human oversight, and the management of confidential information.

Summary

An LLM agent is a mechanism that advances multi-step tasks by repeatedly obtaining the situation, choosing a process, executing a tool, observing the result, and updating its state.

In cyber defense, uses such as organizing threat information, analyzing vulnerabilities, monitoring, and incident response are being explored. Single-agent and multi-agent configurations each have different structures, and how memory, external knowledge, tools, and human approval are combined is important.

On the other hand, there are challenges such as hallucination, error cascades, prompt injection, the handling of confidential information, and inconsistent evaluation methods. LLM agents need to be designed after defining which processes are entrusted to them, which processes require human approval, and which tools and privileges they can access.

About This Article

References

• George Fatouros, Konstantinos Mavrogiorgos, Georgios Makridis, John Soldatos, Dimosthenis Kyriazis, “LLM-Based Agents for Cybersecurity: A Systematic Review of Architectures, Applications, and Open Challenges”

(Last accessed: October 17, 2026)


*This article was compiled based on the author’s understanding, with reference to the literature listed above.