Abstract
The paper proposes a new system design of rolling out Large Language Model (LLM)-driven autonomous security agents in enterprise cybersecurity. Cyber threats are becoming more complex and security operations centres (SOCs) are being overwhelmed by alerts, which is why traditional Security Orchestration, Automation, and Response (SOAR) systems based on those originally relying on rules are no longer able to cope with new attack patterns. We introduce SENTINEL (Security-Enabled Neural Threat Intelligence and Learning), an architecture, which uses LLMs as the reasoning engine to handle autonomous threat investigation, incident triage, and coordinated autonomous response. Our framework deals with such issues as reliability of agents, resistance to adversarial manipulation, and reasonable limits of human control. A three-environment experimental assessment shows that SENTINEL can be used to classify threats with an accuracy of 94.2% and is able to minimize the mean time to respond (MTTR) by 73-percent and detect 89-percent of new attack measures that could not be detected by traditional systems. We also present a formal verification scheme on how to ensure that agent behavior does not exceed specified safety limits so as to allow reliable autonomous behavior in the production security setting.