Agentic SOC: A Hierarchical Swarm-Orchestrated Multi-Agent LLM Architecture for Autonomous OT Cyber Defense
Md. Abdur Rahman · M. Minhaz Rahman ·
Syed Usman Jamil · Muhammad Ali Paracha · M. Shamim Hossain
Univ. of Prince Mugrin, KSA · KUET, Bangladesh · Charles Sturt Univ., Australia · Macquarie Univ., Australia · King Saud Univ., KSA
The Problem: Traditional SOCs Are Failing OT/ICS
Operational Technology (OT), Industrial Control Systems (ICS), and Cyber-Physical Systems (CPS) represent the backbone of critical national infrastructure — power grids, water treatment, oil pipelines, and manufacturing floors. Yet traditional Security Operations Centers were never designed for this environment. They face:
- Alert overload — thousands of daily events with no contextual OT/ICS understanding
- Centralised decision-making bottlenecks — single points of failure in threat response
- No OT/ICS protocol awareness — blind to Modbus, DNP3, PROFINET, and IEC 61850 traffic
- Human triage cannot scale — analysts overwhelmed, dwell times increasing
- No cross-domain attack correlation — IT/OT kill-chain reconstruction impossible
The Solution: A Three-Tier Swarm-Orchestrated Architecture
AgenticSOC introduces a hierarchical framework of specialised AI agents that collaborate autonomously — each tier handling a distinct layer of the threat response pipeline:
Research Niche: AgenticSOC sits at the frontier of Swarm Intelligence, Multi-Agent LLM Systems, and OT/ICS Cyber Defence — a niche where classical cybersecurity meets autonomous AI. The framework enables "The future SOC will not simply collect alerts. It will reason, collaborate, learn, adapt, and defend."
Back to News