Risk-aware autonomous defence with generative AI

Ethical and accountability challenges in cyber-physical infrastructures
Publication date
2026-01-20
Document type
Conference paper
Author
Geyer, Maximian
Schwab, Jannik
Organisational unit
Fraunhofer Institute for Manufacturing Engineering and Automation IPA
DOI
URI
Conference
Project
DigiBattPro 4.0
Publisher
Universitätsbibliothek der HSU/UniBw H
Book title
Artificial Intelligence in Security and Defense : Proceedings of the workshop AI4SD
First page
42
Last page
49
Is part of
Peer-reviewed
✅
Part of the university bibliography
Nein
File(s)
Language
English
Keyword
Industrial cybersecurity
Autonomous cyber defence
Large Language Models (LLM)
Retrieval-augmented generation
Risk-based decision framework
ISO/IEC 27001
NIS2 directive
Critical infrastructure protection
Abstract
The integration of artificial intelligence into industrial cybersecurity creates unique challenges at the intersection of technical efficiency, accountability, and ethics—especially in critical infrastructures governed by regulations like NIS2 and ISO 27001. We introduce AIOD, an autonomous cyber defence system that combines large language models (LLM), retrieval-augmented generation (RAG), and a risk-based decision framework derived from ISO 27001. Unlike conventional Endpoint Detection and Response (EDR) or Security Operations Center (SOC) playbooks, AIOD autonomously interprets incidents, selects organisational risk policies, and generates executable mitigation code under auditable constraints. Evaluated in a controlled Industry 4.0-inspired testbed with replayed events, AIOD achieved sub-minute containment of port scans and sub-10-minute mitigation for malware surrogates (EICAR-based), demonstrating potential for near-real-time response under simplified but representative conditions. Our findings highlight not only the technical potential of LLM-based cyber defence but also raise critical questions around safety, the creative interpretation of vague policies, and human oversight—underscoring the need for governance frameworks to responsibly deploy such systems in cybersecurity and critical infrastructure.
Version
Published version
Access right on openHSU
Open access