SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response

The Gap in AI Security Testing

Current benchmarks for AI security agents test them in pristine environments before any attack happens. But real security teams face a much harder problem: investigating a system after it's been compromised, sifting through logs and artifacts to find what attackers did, what's still broken, and how to fix it. SecRespond closes this gap by creating the first benchmark that directly evaluates LLM agents on post-compromise incident response—the messy, high-stakes work that actually happens in security operations centers.

How the Benchmark Works

The authors built SecRespond around 10 realistic "cyber ranges"—each a forensic snapshot of an actual compromised cloud host. An agent receives three things: a disk image, security alerts from a host protection tool, and vulnerability scan results. Its job is three-fold: produce a forensic report identifying what intruders did, document baseline risks (configuration problems), catalog vulnerability risks, and propose a remediation plan.

The test scenarios span real diversity: 4 different attack entry points, 21 distinct ATT&CK techniques (a taxonomy of adversary behaviors), and 5 operating systems. This isn't a toy dataset—it reflects the messy variety of actual incidents.

The authors evaluated 23 state-of-the-art LLMs (including GPT-4, Claude, and open-source models) using the OpenCode agent harness, which gives agents access to CLI commands and file-system tools, simulating what a human analyst would use during investigation.

The Striking Finding

Despite LLMs' recent advances, no model achieved complete detection and remediation on even a single test case. The agents show a consistent weakness pattern: they're decent at acting on explicit alerts (the "easy" part), but they consistently fail at two critical tasks. First, they struggle to proactively search the disk for silent intrusions—attacks that didn't trigger alerts. Second, they can't produce comprehensive, verified remediation plans. When they do suggest fixes, those fixes often lack verification or miss interconnected problems.

This isn't about any single model being weak; it's a systemic bottleneck. Even frontier models that excel at coding or reasoning tasks break down when faced with the open-ended exploration and rigorous verification demanded by real incident response.

Why It Matters

As organizations increasingly deploy LLM agents with CLI access to critical systems, understanding their failure modes in realistic scenarios is essential. A false sense of security—believing an AI can handle post-compromise investigation—could be worse than no automation at all. SecRespond provides concrete, reproducible evidence of where these agents fall short, directing future research toward solving genuine operational problems rather than gaming idealized benchmarks. The public release of the benchmark and test cases means the community can now measure progress on a problem that actually reflects security work.