Machine-Speed Adversaries: Red-Team and Blue-Team Agent Swarms
An attacker that changes its plan after a failed attempt asks more of a defense than an attacker that repeats the same sequence. The defender has to recognize what changed, investigate it, and decide whether its previous response still holds. Agentic systems can move some of that judgment into a software loop on either side of an intrusion. They can also put a wrong judgment into action before anyone notices.
The architecture proposed here divides defensive work between an incident commander and specialist agents. The commander holds the incident plan; specialists investigate bounded questions; a separate authority boundary controls containment. I use swarm to mean this coordinated division of work, not a collection of agents free to act on the same systems.
There is a case for that split when an incident crosses hosts, networks, and identities. There is no reason to assume the split wins by default. A single agent can re-plan too, and every additional agent introduces a handoff that can lose evidence, add delay, or repeat a mistake. This is a design argument, not a report of a deployed or benchmarked defensive system.
A scripted attack and an agentic attack are different objects
The useful distinction is between a policy whose responses were specified in advance and a system that can generate a new plan from observations. It is not between software that reacts and software that cannot. Scripts can branch, retry, and respond to failures; conventional security automation already does.
An agent adds a model that can interpret a tool result and propose a next step outside a fixed sequence. Whether that step is useful depends on its tools, evidence, permissions, and reliability. A failed connection might prompt a new hypothesis, or a confident misunderstanding. Autonomy does not settle which.
The August 2026 Trident preprint gives a concrete reason to test this distinction. Its authors generate attack policies against learned defenders in CAGE 4 and CyberWheel, and report weaknesses that their fixed heuristic attacker baselines did not expose. These are results in cyber simulation environments, not measurements of enterprise intrusion speed. The implication for this design is narrower: a defense should be tested against an adversary that can change its strategy, not only against the sequences its developers anticipated.
Signatures and runbooks still have work to do. A reliable rule for a known condition can be cheaper, faster, and easier to audit than model inference. Agentic investigation is most interesting where the observations do not yet fit a known response.
What changes across an intrusion
The intrusion stages remain useful, but the defender should ask what an attacker could learn at each one. The following are threat-model examples, not a claim that one evaluated agent reliably performs the entire chain.
During reconnaissance and initial access, an agent could use observed services and failed attempts to revise its choice of target. The defensive question is whether exposure and access telemetry can be joined quickly enough to recognize that sequence. A model’s familiarity with a vulnerability does not establish that it can exploit the deployed system.
During lateral movement, each newly observed host or identity can change the attacker’s view of reachable systems. For the defender, host evidence, network flows, and identity events become parts of the same investigation. They should remain linked even when different specialists inspect them.
During collection, exfiltration, and persistence, a response has to account for paths that remain available after the first intervention. Blocking one connection does not establish that access has been removed. The design needs to test the scope of containment, not merely record that a control accepted an action.
Concurrent activity adds a separate problem. Several agents, or several human operators, may be involved. Treating unrelated activity as one campaign can hide a second incident; treating one campaign as unrelated alerts can lose the connection that matters. Agent count on the attacking side does not tell the defender how many agents to deploy.
Measure the response gap, not a universal speed advantage
Removing a human handoff can shorten an attack or an investigation. It does not eliminate tool latency, missing evidence, failed actions, or the time needed to verify a conclusion. Neither research result discussed here establishes a general minutes-versus-hours gap between agentic attackers and human defenders.
The useful clocks are local: time from observable activity to detection, from detection to an authorized decision, and from that decision to verified containment. If the delay is a queue, parallel investigation may help. If it is missing telemetry, adding agents may only produce more speculation. If a known condition has a safe deterministic response, an existing runbook may already be the fastest path.
Human authority should therefore be placed deliberately. A response policy can pre-authorize bounded actions and require approval for consequential ones. The goal is to remove unnecessary waiting without treating the wait for a necessary safety decision as a defect.
The case for specialists
A single capable agent is a serious baseline. It can revise a plan, call different tools, and keep structured incident state outside its context window. For a narrow investigation, it may be all the system needs.
The case for a swarm starts where the work separates. Host forensics and identity analysis need different evidence and tools. Giving each specialist a bounded question can keep irrelevant material out of its context and limit the permissions it needs. Independent investigations can run in parallel while the commander tracks how their findings bear on the incident.
Those are architectural opportunities, not guaranteed gains. A specialist may omit the detail another needs. Two agents using the same evidence and model may repeat the same error. The commander can become a bottleneck, or spend more time reconciling reports than a single agent would have spent investigating. The split earns its place only if those costs are outweighed by better decisions, safer permissions, or faster verified response.
The commander revises the plan within a fixed authority boundary
The commander chooses whom to involve and what to ask as evidence arrives. Suppose a forensics specialist reports a suspected outbound connection. The commander can ask a network specialist to confirm it and an identity specialist to check the associated access. Their findings may support the initial hypothesis or require a different investigation.
That flexibility belongs in the investigation plan. Approval gates, evidence requirements, and limits on action must remain enforceable regardless of the plan the model produces. A runbook can supply a verified subroutine; the commander need not invent every step anew.
Specialists are narrow on purpose. Triage scopes the incident; forensics reads host artifacts; network analysis reads flows; identity analysis examines principals and sessions. The containment component receives only authorized actions. Its permissions should not become available to every investigator merely because they share a coordinator.
Coordination is a protocol, not a shared brain
Routing every artifact through the commander’s context can recreate the bottleneck the split was meant to remove. Specialists should be able to exchange bounded findings directly, with the exchange recorded in the incident state. A forensics agent can send an indicator to an intelligence specialist without asking the commander to copy it across.
A2A supplies concepts for this exchange: Agent Cards describe capabilities, while messages, tasks, and artifacts carry work between services. That permits different runtimes and models to participate. It does not make a finding true, authorize a containment action, or ensure that the recipient interpreted the task correctly.
The application still needs a shared incident identifier, evidence references, observation times, and explicit distinctions between a hypothesis, a confirmed finding, and an action request. Direct communication must not become a way to bypass the commander’s incident state or the action policy. A cheaper model may suit a bounded task, but model choice is an evaluation decision, not a cost saving the protocol guarantees.
Containment has to be real, and verification has to be earned
For a system entrusted with response, an analysis is not yet containment. An isolation request has to change reachability; an access revocation has to affect the sessions or credentials in scope. A swarm that narrates containment without effecting it has produced faster paperwork.
The action result and the security result are different evidence. A control plane may acknowledge a request before it takes effect, and a successful change may leave another path open. Verification should check the intended postcondition against fresh state: which host is isolated, which connection is blocked, which access has stopped working, and what remains unresolved.
Silence from an alert is not proof of containment. Nor does verifying one blocked path prove that the entire incident is resolved. The incident record must retain the scope of each check and the gaps in visibility. If the system cannot verify an outcome, it should report that uncertainty rather than close the incident.
Figure 1 · A defensive swarm with bounded authority
Specialists exchange structured findings directly; the commander revises the incident plan.
Building one: the parts that have to be right
Start with an incident scope and an authority model before choosing how many agents to run. Specify the available evidence, the permitted actions, the conditions for escalation, and the postconditions that count as containment. Enforce action permissions outside model prompts. A prompt explains the policy; it is not the control that prevents an unauthorized action.
For the swarm candidate, give each specialist a narrow remit and a structured result contract. Keep evidence references alongside conclusions so the commander can inspect their basis. Choose models using task-level evaluations: a smaller model is useful only if its errors and latency are acceptable for that role. Count retries and reconciliation in the cost of the whole incident.
Separate telemetry interfaces from actuator interfaces. Log search, endpoint inspection, flow data, and identity lookup should expose consistent contracts in the range and in production. Isolation, blocking, and revocation need their own permission checks and observable outcomes. Shared contracts make replay and comparison possible; they do not guarantee that a simulated environment captures production behavior.
Record enough state to recover from an interrupted or mistaken action. Where an action is reversible, test the reversal rather than assuming it works. Containment must be scoped to the intended asset and authorized under the current incident state, including when a delayed task arrives after the plan has changed.
Give the operator status cards for the incident and an inspectable record of tasks, evidence, tool calls, approvals, and results. Agent-authored explanations help a person follow the investigation, but they are not a complete account of why a model produced an answer. The audit trail should show what the system actually read and did. The operator needs a way to stop further action, not just a transcript to read afterward.
In the test range, reset incidents, messages, surfaces, and running attack processes between exercises. Preserve the evidence needed for evaluation, and cancel or reject in-flight work from the previous run. Otherwise an apparently successful response may depend on state left behind by an earlier test.
Rehearse against instrumented services in an isolated, authorized range, with attack processes that produce actual artifacts rather than only a narrated timeline. Include cases the defense was not tuned on. The point of a range is to be surprised cheaply.
Where the swarm breaks
Taking the design seriously means naming its failure modes rather than assuming them away.
The April 2026 Cyber Defense Benchmark preprint is a useful warning. It evaluates agents hunting for malicious events in Windows event logs assembled into simulated campaigns. The authors report that none of the five tested models met their passing criterion. This is a particular threat-hunting benchmark, not a test of the swarm proposed here, but it gives no basis for treating competent autonomous investigation as a solved component that only needs orchestration.
Confident error is especially dangerous when it reaches an actuator before a human can intervene. A commander that mistakes a benign administrative tool for an implant may isolate a healthy production host. Speed is neutral; it accelerates mistakes as readily as responses.
Correlation errors can misdirect the investigation. Treating two unrelated incidents as one campaign wastes effort and can mask the second attacker; splitting one campaign into two loses the thread that would have revealed the shared infrastructure. Both possibilities have to remain open until the evidence distinguishes them.
Containment authority has its own blast radius. The actions that make the swarm effective—isolating hosts, cutting network paths, revoking identities—are the same actions that, misfired or subverted, become a denial-of-service the defender inflicts on itself. An attacker who understands that a swarm will auto-isolate on a given signal can try to trigger it.
Coordination adds its own failures. Specialists can amplify a shared false assumption, duplicate work, or act on different versions of the incident. More agreement is not independent confirmation when every agent is repeating the same source. A commander must be able to preserve disagreement and ask for evidence that could distinguish the competing explanations.
These are reasons to limit autonomy and, in some settings, to reject the swarm in favor of a simpler system. Reversibility alone does not make an action safe to automate: a temporary isolation can still disrupt a critical service. Pre-authorization needs a defined scope and acceptable impact. High-consequence or hard-to-reverse actions should reach a human with the evidence assembled; uncertainty should narrow what the system may do.
What the swarm has to prove
The evaluation should compare three candidates: a deterministic runbook for known cases, a capable single agent that can re-plan and use structured state, and the proposed commander-and-specialist system. Give the agentic candidates the same telemetry access, available actions, and authority limits. Compare them under matched budgets, and report the trade-off when the swarm spends more compute or makes more tool calls.
Measure time to verified containment, not time to the first plausible report. Record missed malicious activity, unnecessary containment, disruption to benign services, escalation load, and total cost. Include tool failures, delayed observations, conflicting findings, concurrent incidents, and attempts that change after an intervention. A system that closes incidents quickly by over-isolating assets has not necessarily improved defense.
To test the architectural claim, vary the architecture. Does parallel work help after message overhead is counted? Does specialist separation improve evidence quality or just produce more summaries? Does independent verification catch failures missed by the acting component? These comparisons would show which parts earn their complexity.
If a single agent reaches the same verified outcomes with less disruption, latency, and cost, use it. The proposal is worth pursuing where specialization produces a measurable advantage, not where the diagram contains more agents.
Dual use is not a footnote
Planning, tool use, and agent coordination can serve both offense and defense. The overlap does not make their jobs identical: an attacker may need one path to succeed, while a defender has to understand the scope of compromise and the consequences of its response. Improving a defensive coordinator does not automatically establish an equal offensive capability, but the underlying methods can be repurposed.
That makes authorization and isolation part of the research design. Test within a confined range, control access to actuators, and assess what released tools or artifacts would enable outside that setting. A successful exercise is evidence about the exercise, not permission to give the system equivalent authority over production.
What follows
The case for a defensive swarm rests on a division of work: specialists can investigate different evidence under narrower permissions while a commander keeps the incident plan coherent. Whether that division improves the outcome remains an empirical question. The research discussed here motivates harder tests of autonomous defense; it does not settle the architecture.
Keep the authority boundary fixed while the investigation changes. Require evidence that an authorized action achieved its intended effect. Add another agent only when the comparison shows what it buys.