---
title: "Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.02422v1"
permalink: "https://feed.astralor.com/items/itm_9365c044970146e8b896d6cc"
published: "2026-08-03T16:03:16.000Z"
score: 77
channel: "ai"
tags: ["arXiv","Incident Response","Large Language Models","Digital twin","Agent","Cybersecurity"]
---

# Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning

## AI commentary

> The most notable aspect of this paper is how it combines the rigor of decision-theoretic planning with the flexibility of LLMs, avoiding blind long-plan generation by separating high-level strategy from low-level execution. It is a valuable reference for teams working on security operation automation and AI agent deployment.

## At a glance

Incident response is currently managed by security operators using predefined playbooks, resulting in slow and labor-intensive decision-making. This paper proposes a principled LLM-based planning method that combines decision-theoretic planning with LLM-generated response commands. The approach uses a rollout planner to compute a high-level response strategy for allocating security resources (tactical scale), then a lightweight LLM agent translates it into executable commands (operational scale), with a digital twin supporting tactical simulation and operational emulation. Across three attack scenarios, the method reduces recovery execution time by 15.1% on average and increases recovery rate by 33.6% over frontier LLM baselines.

## Key points

- Proposes a dual-scale agentic incident response framework combining decision-theoretic planning with LLM-generated commands.
- Uses a digital twin to bridge tactical planning (simulation) and operational execution (emulation).
- Across three attack scenarios, recovery execution time is reduced by 15.1% on average and recovery rate improves by 33.6%.

## Full text

Incident response is currently managed by security operators using predefined playbooks, resulting in slow, labor-intensive security decision-making processes. Consequently, there is a growing need for automated incident response planning. Decision-theoretic approaches based on control, optimization, and reinforcement learning have been proposed to automate such planning tasks with well-grounded approaches, yet most of which, while guaranteeing strong performance, are limited to abstract models and cannot be directly applied to operational systems. A promising approach to mitigate this limitation is to use the security knowledge embedded in large language models (LLMs) to develop agentic response systems. However, current agentic approaches rely on repeated invocations of the LLM to generate a response plan, which is unreliable and limits the planning horizon due to hallucination. In this paper, we develop a principled LLM-based planning method by combining decision-theoretic planning with LLM-generated response commands. The proposed agentic incident response approach uses a rollout planner to compute a high-level response strategy that allocates security resources (the tactical scale), which is then translated into executable commands by a lightweight LLM agent (the operational scale). Within this architecture, we use a digital twin that supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios, our agentic approach reduces recovery execution time by 15.1\% on average and increases the recovery rate by 33.6\% over frontier LLM baselines.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_9365c044970146e8b896d6cc