Journal of Telecommunication, Switching Systems and Networks Review Article
Security Operations Centers (SOCs) must interpret large volumes of alerts, logs, endpoint events, identity signals, threat intelligence, and cloud activity while responding quickly to incidents. Conventional automation reduces repetitive work, but it often depends on fixed rules and separate tools that still require analysts to assemble context manually. This review presents a practical framework for AI (Artificial Intelligence) agent-based security copilots that combine large language models, machine learning, retrieval-augmented generation (RAG), security analytics, and controlled tools used to support SOC teams. The proposed design uses specialized agents for alert triage, investigation, threat intelligence, detection engineering, response planning, and reporting, coordinated by an orchestration layer. Agents can collect evidence, summarize events, map behaviors to attack techniques, suggest hypotheses, and prepare response actions, but high-impact changes remain subject to human approval. The framework also emphasizes trustworthy operation through evidence citation, least-privilege access, policy gates, audit logs, prompt-injection resistance, privacy controls, and continuous evaluation. Electrical and electronics relevance is included through monitoring of Internet of Things devices, industrial control systems, programmable logic controllers (PLC), edge gateways, sensors, firmware, and operational technology (OT) networks. Recent research and industry practice indicate that large language models and autonomous agents can improve security workflow automation, while important limitations remain around hallucination, data leakage, adversarial manipulation, excessive agency, and model drift. The paper therefore treats the security copilot as an analyst augmentation layer rather than an unsupervised replacement for professional judgment.
Abstract
Security Operations Centers (SOCs) must interpret large volumes of alerts, logs, endpoint events, identity signals, threat intelligence, and cloud activity while responding quickly to incidents. Conventional automation reduces repetitive work, but it often depends on fixed rules and separate tools that still require analysts to assemble context manually. This review presents a practical framework for AI (Artificial Intelligence) agent-based security copilots that combine large language models, machine learning, retrieval-augmented generation (RAG), security analytics, and controlled tools used to support SOC teams. The proposed design uses specialized agents for alert triage, investigation, threat intelligence, detection engineering, response planning, and reporting, coordinated by an orchestration layer. Agents can collect evidence, summarize events, map behaviors to attack techniques, suggest hypotheses, and prepare response actions, but high-impact changes remain subject to human approval. The framework also emphasizes trustworthy operation through evidence citation, least-privilege access, policy gates, audit logs, prompt-injection resistance, privacy controls, and continuous evaluation. Electrical and electronics relevance is included through monitoring of Internet of Things devices, industrial control systems, programmable logic controllers (PLC), edge gateways, sensors, firmware, and operational technology (OT) networks. Recent research and industry practice indicate that large language models and autonomous agents can improve security workflow automation, while important limitations remain around hallucination, data leakage, adversarial manipulation, excessive agency, and model drift. The paper therefore treats the security copilot as an analyst augmentation layer rather than an unsupervised replacement for professional judgment.
Keywords
References (15)
- Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser Ł, Polosukhin I. Attention is all you need. Advances in neural information processing systems. 2017;30.
- National Institute of Standards and Technology (US), National Institute of Standards and Technology (US). NIST Cybersecurity Framework 2.0: Quick-start Guide for Creating and Using Organizational Profiles. US Department of Commerce, National Institute of Standards and Technology; 2024.
- Nelson A, Rekhi S, Souppaya M, Scarfone K. Incident response recommendations and considerations for cybersecurity risk management. NIST special publication. 2025 Apr;800.
- AI N. Artificial intelligence risk management framework (AI RMF 1.0). URL: https://nvlpubs. nist. gov/nistpubs/ai/nist. ai. 2023 Jan;1(0):0-1.
- AI N. Artificial intelligence risk management framework: Generative artificial intelligence profile. NIST Trustworthy and Responsible AI Gaithersburg, MD, USA. 2024 Jul.
- Mc Cabe M, Houmb SH. Enhancing the MITRE ATT&CK® Framework for Cyber-Physical Systems Using Insights from Advanced Persistent Threats. Applied Sciences. 2026 Feb 12;16(4):1815.
- Xu H, Wang S, Li N, Wang K, Zhao Y, Chen K, Yu T, Liu Y, Wang H. Large language models for cyber security: A systematic literature review. ACM Transactions on Software Engineering and Methodology. 2025 Sep.
- Srinivas S, Kirk B, Zendejas J, Espino M, Boskovich M, Bari A, Dajani K, Alzahrani N. AI-augmented SOC: A survey of LLMs and agents for security automation. Journal of Cybersecurity and Privacy. 2025 Nov 5;5(4):95.
- Habibzadeh A, Feyzi F, Atani RE. Large language models for security operations centers: A comprehensive survey. Journal of Electrical and Computer Engineering. 2026;2026(1):3383674.
- YAZI G. Large language models (llms) for cybersecurity: A systematic review. WORLD. 2024;13(1):057-69.
- Barrios-González M, Aguiar-Pérez JM, Pérez-Juárez MÁ, Castañeda-de-Benito E. Redefining cyber threat intelligence with artificial intelligence: from data processing to predictive insights and human–AI collaboration. Applied Sciences. 2026 Feb 6;16(3):1668.
- Jakkal V. Microsoft unveils Microsoft Security Copilot agents and new protections for AI. Microsoft Security Blog. 2025 Mar.
- Dey R, Viradecha P. Infrastructure for the Agentic Web: Gap Analysis and Architecture from the Agentverse Platform. arXiv preprint arXiv:2606.20570. 2026 Apr 26.
- Upadhyay AK, Gupta P, Varshney PK. Recent innovations in cyber security: Emerging challenges, potential opportunities, and future governance perspectives. EDPACS. 2026 Jun 13:1-8.
- Rose S, Borchert O, Mitchell S, Connelly S. Zero trust architecture. NIST special publication. 2020 Aug 10;800(207):1-52.