# SecMate: Multi-Agent Adaptive Cybersecurity Troubleshooting with Tri-Context Personalization

arXiv: https://arxiv.org/abs/2604.26394 · HTML: https://mlsanity.com/paper/2604.26394/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 9 of its 39 references that are in the map.
- First posted on arXiv 29 Apr 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 9 of 9)

- [CR-Walker: Tree-Structured Graph Reasoning and Dialog Acts for Conversational Recommendation](https://mlsanity.com/paper/2010.10333/) (2020)
- [MG-ShopDial: A Multi-Goal Conversational Dataset for e-Commerce](https://mlsanity.com/paper/2304.12636/) (2023)
- [Cyber Sentinel: Exploring Conversational Agents in Streamlining Security Tasks with GPT-4](https://mlsanity.com/paper/2309.16422/) (2023)
- [CYGENT: A cybersecurity conversational agent with log summarization powered by GPT-3](https://mlsanity.com/paper/2403.17160/) (2024)
- [ClueCart: Supporting Game Story Interpretation and Narrative Inference from Fragmented Clues](https://mlsanity.com/paper/2503.06098/) (2025)
- [ProfiLLM: An LLM-Based Framework for Implicit Profiling of Chatbot Users](https://mlsanity.com/paper/2506.13980/) (2025)
- [To Recommend or Not: Recommendability Identification in Conversations with Pre-trained Language Models](https://mlsanity.com/paper/2403.18628/) (2024)
- [The Dangerous Combo: Fileless Malware and Cryptojacking](https://mlsanity.com/paper/2203.03175/) (2022)
- [Cybersecurity as a Service](https://mlsanity.com/paper/2402.13965/) (2024)

## Abstract (arXiv)

Recent advances in large language models and agentic frameworks have enabled virtual customer assistants (VCAs) for complex support. We present SecMate, a multi-agent VCA for cybersecurity troubleshooting that integrates device, user, and service specificity from conversational and device-level signals. Device specificity is provided by a lightweight local diagnostic utility, while user specificity relies on implicit proficiency inference and profile-aware troubleshooting. Service specificity is achieved through a proactive, context-aware recommender. We evaluate SecMate in a controlled study with 144 participants and 711 conversations. Device-level evidence increased correct resolutions from about 50% to over 90% relative to an LLM-only baseline, while step-by-step guidance improved pleasantness and reduced user burden. The recommender achieved high relevance (MRR@1=0.75), and participants showed strong willingness to substitute human IT support at costs well below human benchmarks. We release the full code base and a richly annotated dataset to support reproducible research on adaptive VCAs.