Can AI defend the digital world all by itself?

Imagine a team of super-experts working 24/7 to protect your data without ever getting tired. It's not a sci-fi movie, but the future of cybersecurity! Until recently, AI was like an assistant that summarized texts or explained complex concepts. It was useful, but it couldn't truly 'act.'

Today, things are changing rapidly. We are moving from simple language models to systems called 'Agents.' An agent doesn't just talk: it knows how to use tools, analyze real data, and make decisions. The real revolution is the shift from single models to multi-agent systems. Imagine a squad of digital robots where each has a specific task: one monitors the network, one analyzes suspects, and another coordinates actions.

This evolution is crucial because cyber-attacks are becoming faster and more complex. To stop them, we need systems that don't just reason, but collaborate autonomously and safely. The challenge? Ensuring these agents always act correctly, without making mistakes during critical operations. The future of security won't just be software, but a true intelligent digital army.

The evolution described in the paper follows a five-generation taxonomy marking the shift from simple Natural Language Processing (NLP) to operational autonomy. In the first generation, Large Language Models (LLMs) act as simple textual reasoning engines. With the advent of the second and third generations, agents begin to interact with external tools, such as databases or vulnerability scanners, overcoming the limitation of lacking up-to-date data.

The most advanced frontier involves multi-agent systems (MAS). In these frameworks, several specialized agents communicate through structured protocols. This approach solves the 'hort-term memory' problem of individual models and allows for tackling complex tasks that require long-horizon reasoning. However, the introduction of semi-autonomous pipelines raises critical questions about 'esponse validation': how can we be sure that an agent, while trying to block an attack, doesn't accidentally shut down a vital service? Research is focusing on creating 'guardrails' and specific benchmarks to test tool-use precision and inter-agent coordination, ensuring that autonomy does not become a risk to the stability of information systems.