An email arrives at a financial institution asking an employee to change a supplier’s payment details. The message looks familiar, but a security tool flags it as suspicious. Is it a genuine request, an attempted fraud, or an early sign that an account has been compromised? A related challenge is explored in CyberAId’s post on client impersonation in wealth management.

This illustrative example shows why an alert is only the beginning of an investigation. A security team may need to examine the message, check related activity and understand the consequences for the business before deciding what to do.

CyberAId is developing an approach to help bring those pieces together. Its design for coordinating AI agents sets out how specialised assistants should work with security tools and present evidence-based recommendations to people. The aim is to give analysts a clearer picture of an incident while keeping consequential decisions subject to appropriate review.

Bringing the right expertise together

An AI agent is a software assistant that can use tools and follow up on what it finds. In cybersecurity, one agent might examine suspicious emails, while another looks for unusual activity in system records. Each has a defined role.

CyberAId’s design includes a coordinator that directs work to the relevant specialists and brings their findings together. The coordinator manages the investigation; detailed analysis belongs to the specialists.

In our email example, an email specialist could examine signs of impersonation or a malicious link. A specialist reviewing system activity could look for related events, such as an unusual login. These are different questions about the same potential incident. Connecting their findings gives an analyst more context than an isolated warning.

The design also allows one investigation to lead to another. If an initial check raises a new question, the relevant specialist can be asked to follow it up. This reflects how security teams already work: each piece of evidence helps determine what to examine next.

Showing the evidence behind the recommendation

A nicely written explanation can sound convincing even when it is wrong. For this reason, CyberAId’s design asks agents to return findings that connect their conclusions to the evidence they examined.

For the suspicious email, a useful finding should explain what raised concern and point to the supporting records. It should also identify which agent produced the assessment and how confident it is. An analyst needs enough information to check the recommendation, challenge it and decide whether further investigation is necessary.

Sensitive information also needs boundaries. The proposed design limits which information an agent may access and uses references to evidence rather than copying the underlying material into every finding. This is intended to help keep an investigation traceable while limiting unnecessary duplication of confidential data.

Disagreement remains visible. If one specialist finds little cause for concern while another identifies a serious warning sign, the design calls for both assessments to reach a human reviewer with their evidence. That disagreement may be exactly what deserves closer attention.

Helping people decide what happens next

Different actions carry different consequences. Looking up a threat indicator is a routine investigative step. Restricting access to a business system can disrupt legitimate work.

CyberAId’s proposed review approach takes that difference into account. Routine, reversible checks can proceed automatically, while actions with greater impact require human approval. The review level also considers the seriousness of the finding and the agent’s confidence. High-impact actions require approval regardless of how confident an agent claims to be.

Analysts can reject or correct recommendations, and the design records those decisions alongside the findings. The same evidence can then support reporting. A reporting agent is intended to turn validated findings into an incident account or management summary, with conclusions that remain connected to their sources.

Turning research into a testable design

This work draws on CyberAId-supported research into large language model agents for cybersecurity. Our systematic review examined 59 studies and found promising examples of coordinated agents, alongside limited evidence for financial-sector use. None of the reviewed studies reported evaluation in a live production environment under the review’s highest evaluation category.

Those findings help explain the project’s emphasis on evidence and review. They also underline the need to test the proposed workflows carefully. An architecture can specify how an investigation should proceed; practical evaluation must establish whether it helps analysts, how it handles errors and whether its recommendations are useful.

CyberAId’s ongoing work is moving towards implementation and evaluation of this shared approach. For a security team handling an uncertain alert, the intended benefit is concrete: understand what was found, see why it matters and make an informed decision about the next step.

Related publication: LLM-Based Agents for Cybersecurity (open-access paper)