Paper

{
  "raw_xml": "<entry>\n    <id>http://arxiv.org/abs/2603.20131v1</id>\n    <title>An Agentic Multi-Agent Architecture for Cybersecurity Risk Management</title>\n    <updated>2026-03-20T17:00:05Z</updated>\n    <link href='https://arxiv.org/abs/2603.20131v1' rel='alternate' type='text/html'/>\n    <link href='https://arxiv.org/pdf/2603.20131v1' rel='related' title='pdf' type='application/pdf'/>\n    <summary>Getting a real cybersecurity risk assessment for a small organization is expensive -- a NIST CSF-aligned engagement runs $15,000 on the low end, takes weeks, and depends on practitioners who are genuinely scarce. Most small companies skip it entirely. We built a six-agent AI system where each agent handles one analytical stage: profiling the organization, mapping assets, analyzing threats, evaluating controls, scoring risks, and generating recommendations. Agents share a persistent context that grows as the assessment proceeds, so later agents build on what earlier ones concluded -- the mechanism that distinguishes this from standard sequential agent pipelines. We tested it on a 15-person HIPAA-covered healthcare company and compared outputs to independent assessments by three CISSP practitioners -- the system agreed with them 85% of the time on severity classifications, covered 92% of identified risks, and finished in under 15 minutes. We then ran 30 repeated single-agent assessments across five synthetic but sector-realistic organizational profiles in healthcare, fintech, manufacturing, retail, and SaaS, comparing a general-purpose Mistral-7B against a domain fine-tuned model. Both completed every run. The fine-tuned model flagged threats the baseline could not see at all: PHI exposure in healthcare, OT/IIoT vulnerabilities in manufacturing, platform-specific risks in retail. The full multi-agent pipeline, however, failed every one of 30 attempts on a Tesla T4 with its 4,096-token default context window -- context capacity, not model quality, turned out to be the binding constraint.</summary>\n    <category scheme='http://arxiv.org/schemas/atom' term='eess.SY'/>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.AI'/>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.CR'/>\n    <published>2026-03-20T17:00:05Z</published>\n    <arxiv:comment>15 pages, 1 figure, 2 tables. Submitted to AICTC 2026 (Springer LNCS)</arxiv:comment>\n    <arxiv:primary_category term='eess.SY'/>\n    <author>\n      <name>Ravish Gupta</name>\n      <arxiv:affiliation>BigCommerce</arxiv:affiliation>\n    </author>\n    <author>\n      <name>Saket Kumar</name>\n      <arxiv:affiliation>University at Buffalo, The State University of New York, Buffalo, NY, USA</arxiv:affiliation>\n    </author>\n    <author>\n      <name>Shreeya Sharma</name>\n      <arxiv:affiliation>Microsoft</arxiv:affiliation>\n    </author>\n    <author>\n      <name>Maulik Dang</name>\n      <arxiv:affiliation>Amazon</arxiv:affiliation>\n    </author>\n    <author>\n      <name>Abhishek Aggarwal</name>\n      <arxiv:affiliation>Amazon</arxiv:affiliation>\n    </author>\n  </entry>"
}