Autonomous Cyberdefense Needs More Than an LLM

Autonomous cyberdefense is often described as a model that detects an attack and responds immediately. That description hides the hard part: deciding which actions are allowed when observations are partial, the adversary is adaptive and the cost of a mistake is asymmetric.

A more useful framing is a bounded control loop. The loop can automate repetitive transitions, but every transition needs evidence, a policy and a way to stop or recover.

1. From prediction to control

Let $z_t$ represent the security state estimated at time $t$, $o_t$ the observations and $a_t$ a candidate action. A simplified loop is:

$$z_{t+1} = f(z_t, o_t, a_t), \qquad a_t \sim \pi(\cdot \mid z_t, P, R),$$

where $P$ is the active policy and $R$ contains recovery constraints. The model may help estimate $z_t$ or rank actions, but it should not silently redefine $P$.

2. Four layers of autonomy

It is useful to separate:

1. Detection: identify a deviation and attach evidence.
2. Interpretation: relate the deviation to assets, tactics and plausible causes.
3. Planning: compare actions that are permitted by policy.
4. Execution: apply a reversible or approved change and observe its effect.

An LLM is a natural assistant for interpretation and plan drafting. It is a much weaker authority for detection and execution, especially when the input contains untrusted text.

3. The human checkpoint is part of the design

Human oversight should not be a button added at the end of a demo. The system should show the evidence, the proposed action, the expected effect, the reversibility and the conditions that would cancel it. Low-risk actions can be automated under policy. High-impact actions should require explicit approval.

The boundary can be represented as a risk function:

$$\rho(a) = \Pr(\text{harm}\mid a,E) \cdot C(a),$$

where $E$ is the current evidence and $C(a)$ is the consequence of an incorrect action. A threshold should be a governance decision, not a hidden model preference.

4. Recovery and learning

Autonomy without recovery is only fast failure. Every automated action needs a rollback, a timeout or a quarantine path. The result of the action should be logged as feedback, but it should not be treated as an unquestionable label. A failed mitigation can reflect a wrong hypothesis, a stale topology or an unavailable control.

5. How to evaluate autonomous behavior

Report more than detection accuracy:

• time from signal to interpretable evidence,
• unsafe-action rate,
• proportion of actions requiring escalation,
• recovery success and rollback time,
• analyst corrections,
• performance under delayed, missing or manipulated context.

The strongest claim is not that a system acts alone. It is that the system knows when evidence is insufficient, limits its authority and leaves a trace that another person can inspect.

This note is an original synthesis of bounded-autonomy principles for cyberdefense.