Adaptive Incident Prioritization for Security Operations at Scale

arXiv:2607.16963 · cs.CR, cs.IR · Submitted 2026-07-18 · Read on arXiv

Scott Freitas, Amir Gharib, Maayan Magenheim

cs.CR, cs.IR

Submitted: 2026-07-18

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Adaptive Incident Prioritization — 10× in this paper
• Benchmark — 8× in this paper · explained in 2 episodes
• Adaptation — 5× in this paper · explained in 1 episode
• Ablation — 4× in this paper · explained in 1 episode
• Actionability — 3× in this paper · explained in 3 episodes
• Alert Fatigue — 3× in this paper · explained in 1 episode
• Agentic AI — 2× in this paper · explained in 1 episode
• Adam — 1× in this paper · explained in 2 episodes
• Agentic Workflows — 1× in this paper · explained in 1 episode
• Aggregation — 1× in this paper · explained in 1 episode
• Benchmarking — 1× in this paper · explained in 4 episodes
• Clustering — 1× in this paper · explained in 2 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Core — 1× in this paper · explained in 2 episodes
• Explainability — 1× in this paper · explained in 3 episodes
• Personalization — 1× in this paper · explained in 2 episodes
• Provenance — 1× in this paper · explained in 4 episodes
• Reinforcement Learning — 1× in this paper · explained in 4 episodes

Sources

• GenAI-Driven Threat Detection with Microsoft Security Copilot
• That Escalated Quickly: An ML Framework for Alert Prioritization
• A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes
• AI-Driven Security Alert Screening and Alert Fatigue Mitigation in Security Operations Centers: A Survey
• Carbon Filter: Real-time Alert Triage Using Large Scale Clustering and Fast Search
• Automated Alert Classification and Triage (AACT): An Intelligent System for the Prioritisation of Cybersecurity Alerts
• CORTEX: Collaborative LLM Agents for High-Stakes Alert Triage

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs