It is argued that this substrate, not model capability, is the bottleneck on agentic CTI investigation, and CTIFoundry, an agent-native corpus scaffold, is presented.
Abstract
Cyber threat intelligence (CTI) is increasingly consumed not by human analysts but by LLM agents that compose multi-step investigations at query time. The harness side of this shift has matured rapidly (planning loops, tool protocols, context management), but the corpus side has not: threat reports and vulnerability databases are still packaged for retrieval-augmented generation, as opaque chunks behind an embedding index. We argue that this substrate, not model capability, is the bottleneck on agentic CTI investigation, and present CTIFoundry, an agent-native corpus scaffold. At build time, CTIFoundry materializes the latent structure of a CTI corpus: a deterministic ontology graph over four authoritative knowledge bases (CVE, CWE, CAPEC, ATT&CK) whose official cross-references become typed, traversable edges; a span-grounded report layer whose canonical, alias-resolved cross-vendor entities index provenance-carrying chunks; and hybrid dense+lexical retrieval surfaces. At query time this structure is exposed through seven typed tools and three procedural skills mounted on a stock open-source agent harness. On the public CTIConnect benchmark, swapping only the action surface lifts the identically-harnessed agent by +0.19 to +0.28 overall F1 across a four-model, two-provider panel: a small model on CTIFoundry surpasses a flagship on the flat substrate, and the gain is not bought with search effort, since on both Claude models the scaffolded agent is more accurate at roughly half the tool calls. An ablation attributes it: typed structure carries the larger share, procedural skills convert structure into discipline, and the two compose super-additively, because skills bind only to structure that exists.
Cyber Threat Intelligence (CTI) enables Security Operations Centers (SOCs) to understand adversary behavior,
prioritize risks, and respond to cyber threats. However, cur-rent CTI workflows still depend heavily on manual analysis
of unstructured threat reports, vulnerability advisories, open-source intelligence, social media posts, and structured feeds. This
creates operational latency, inconsistent extraction quality, weak provenance, and limited scalability. This paper presents Auto
Threat AI, an agentic and explainable framework for automated CTI extraction, correlation, scoring, and analyst-governed SOC
operationalization. The proposed framework integrates determin-istic indicator extraction, Natural Language Processing (NLP),
schema-guided Large Language Model (LLM) agents, graph-aware threat correlation, bounded risk scoring, evidence-first
explainability, and Human-in-the-Loop (HITL) governance. The system ingests heterogeneous CTI sources, extracts entities and
relations such as IOCs, CVEs, malware, campaigns, threat actors, tools, and techniques, constructs a threat knowledge graph,
gen-erates campaign candidates, and presents risk-ranked intelligence through a SOC dashboard. Experimental evaluation on
safe demonstration CTI data shows that the implemented prototype ingested 6 sources, extracted 36 entities, generated 33
relations, detected 11 threat events, identified 5 campaign candidates, and routed 8 items for HITL review. The results
demonstrate that Auto Threat AI can reduce manual CTI processing effort while improving traceability, explainability, and
analyst trust.
Methari Keeravani· International Journal for Re...· 0 citations
Cyber threat intelligence (CTI) is foundational to modern cyber defense, yet much of it resides in unstructured reports whose volume and heterogeneity far exceed manual analysis, motivating research on automatically constructing knowledge graphs from CTI reports. However, existing approaches mainly extract partial information within a single report, leaving the cross-source setting unexplored, where the same threat is given unrelated names. Our key insight is that attack behaviors, once mapped to MITRE ATT&CK (a standardized catalog of attack techniques), can anchor the rest of a report. Attack behaviors are the adversarial actions a report describes, while contextual entities (e.g., threat actors, campaigns, and affected products) and Indicators of Compromise (IoCs; e.g., IP addresses) are their participants and traces. Attaching them to these anchors places every per-report graph in one canonical space. We realize this insight in BEACON, an LLM-driven framework for cross-source CTI knowledge graph construction. Its first stage extracts each report into a graph under a propose-then-verify paradigm, grounding candidates in report evidence and official ATT&CK definitions, to suppress LLM misclassification and hallucination. Its second stage merges these graphs with a hierarchical alignment strategy that applies signals in decreasing order of determinism, from character-level and semantic similarity to overlapping technique neighborhoods, iterating as merges pool neighborhoods. No existing benchmark links entities to technique anchors or provides cross-source alignment ground truth. We therefore construct and release two human-annotated datasets from 34 sources: to our knowledge the largest for report-level CTI extraction (8,395 elements) and the first for cross-source consolidation (3,487). On them, BEACON outperforms all baselines by at least 23% and 9%, respectively.
TACTIC-KG is introduced, an agentic framework for CSKG construction that decomposes the task into modular, specialized LLM agents responsible for extraction, typing, verification, and curation that improves stability, recall, and graph consistency while reducing deployment cost.
Cyber-capable AI agents combine language models with tools, memory, and execution environments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks against agent components, but provides less guidance on containing a capable agent within the environments used to evaluate it. This review synthesizes five vulnerability classes at that boundary: multi-step offensive chains, objectives that conflict with sandbox boundaries, supply-chain and credential exposure, persistent command-and-control, and the speed of automated action. We use two separate preliminary incident records: the reported July 2026 Hugging Face/OpenAI evaluation breach and Anthropic's subsequent three-incident evaluation review. A comparative evidence protocol distinguishes record-specific factual claims from the shared systems lesson: the evaluation environment is itself part of the security boundary. Across the taxonomy and records, we examine controls for containment, privilege separation, provenance, and responder access, including the dual-use problem that defensive artifacts may also enable misuse. The review identifies practical priorities for evaluating cyber capability together with the security of the environment in which that capability is exercised.
: Mapping unstructured Cyber Threat Intelligence (CTI) reports to the MITRE ATT&CK framework is critical for proactive defence but remains a manual, time-consuming process. Existing automated approaches either rely on black-box language models that lack interpretable reasoning or brittle, rule-based knowledge graphs that fail to scale. To bridge this gap, we propose Graph2TTP, a novel neural-symbolic framework for automated, paragraph-level Tactic, Technique and Procedure (TTP) identification. Graph2TTP leverages the zero-shot comprehension of Large Language Models (LLMs) to automatically extract entities and relations from extensive CTI narratives, constructing rich, localized Cyber Security Knowledge Graphs (CSKGs). We encode these symbolic structures into dense embeddings and process them via a multi-label Edge-featured Graph Attention Network (EGAT). This hybrid architecture delivers both the high-fidelity accuracy of neural networks and the transparent, verifiable reasoning paths required by security analysts. To facilitate rigorous evaluation, we curate and release APTCTI, a real-world dataset comprising 690 Advanced Persistent Threat reports spanning over 18,087 paragraphs. Extensive evaluations across multiple datasets demonstrate that Graph2TTP outperforms state-of-the-art neural baselines (e.g., CySecBERT) by approximately 20% in F1 score, establishing a robust new standard for accurate and interpretable threat intelligence analysis.
Patrick Zounon, Yufei Han, Michel Hurfin et al.· Proceedings of the 23rd Inte...· 0 citations
STINER, a taxonomy and expert-annotated corpus for extracting strategic intelligence from social media streams is introduced, and how social-media-driven extraction can surface early signals of the SafePay ransomware campaign prior to its retrospective characterization in vendor threat landscape reports is illustrated.
Yasir Ech-Chammakhy, Oussama Azrara, J. Chbili et al.· 0 citations
