MaLO: Multi-agent LLM Operations for Autonomous Security

Abstract

Despite the wide adoption of Large Language Models (LLMs) and AI agents in cybersecurity, the impact of agent topology on autonomous cyber operations (ACO) performance remains underexplored. Current agent-based security systems rely on either monolithic LLM prompts or rigid, static pipelines. We present MaLO, a configurable security platform to formalize and evaluate dynamic multi-agent graphs. MaLO provides four graph templates unified by a shared “prompt kernel” and tool interface: Single ReAct, Reasoner–Executor, Orchestrator–Workers, and Orchestrator-Workers with a Critic. We evaluate these architectures across a 42-task benchmark of varying difficulty quantified by our new SOCX metric, and a highly realistic, long-horizon security scenario (NSA CBC) that mirrors realworld task ambiguity. We provide the first systematic analysis of agent topology impact on security operations performance. Our results demonstrate that explicit task decomposition and orchestration significantly improve performance on medium and high-complexity security operations. By achieving a 78.6% success rate in our benchmark and solving tasks up to 40x faster than a human expert baseline, we show that architecture selection is a first-class design decision for autonomous cybersecurity agents.