1 publication

• Published Subscription Review Article 28 Oct 2026

  Security Operations Centers (SOCs) must interpret large volumes of alerts, logs, endpoint events, identity signals, threat intelligence, and cloud activity while responding quickly to incidents. Conventional automation reduces repetitive work, but it often depends on fixed rules and separate tools that still require analysts to assemble context manually. This review presents a practical framework for AI (Artificial Intelligence) agent-based security copilots that combine large language models, machine learning, retrieval-augmented generation (RAG), security analytics, and controlled tools used to support SOC teams. The proposed design uses specialized agents for alert triage, investigation, threat intelligence, detection engineering, response planning, and reporting, coordinated by an orchestration layer. Agents can collect evidence, summarize events, map behaviors to attack techniques, suggest hypotheses, and prepare response actions, but high-impact changes remain subject to human approval. The framework also emphasizes trustworthy operation through evidence citation, least-privilege access, policy gates, audit logs, prompt-injection resistance, privacy controls, and continuous evaluation. Electrical and electronics relevance is included through monitoring of Internet of Things devices, industrial control systems, programmable logic controllers (PLC), edge gateways, sensors, firmware, and operational technology (OT) networks. Recent research and industry practice indicate that large language models and autonomous agents can improve security workflow automation, while important limitations remain around hallucination, data leakage, adversarial manipulation, excessive agency, and model drift. The paper therefore treats the security copilot as an analyst augmentation layer rather than an unsupervised replacement for professional judgment.

  By Sonal Ajit Patil, Geetika Narang

  Abstract: Security Operations Centers (SOCs) must interpret large volumes of alerts, logs, endpoint events, identity signals, threat intelligence, and cloud activity while responding quickly to incidents. Conventional automation reduces repetitive work, but it often depends on fixed rules and separate tools that still require analysts to assemble context manually. This review presents a practical framework for AI (Artificial Intelligence) agent-based security copilots that combine large language models, machine learning, retrieval-augmented generation …

  Published in Journal of Telecommunication, Switching Systems and Networks · Vol. 13, Issue 3, 2026 Read article →