mlsanityData to 14 Oct 2026

TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction

arXiv 2607.05001 ↗First posted 6 Jul 2026cs.CR cs.AI cs.LGcited by 1

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Cyber Threat Intelligence (CTI) reports are predominantly unstructured, heterogeneous, and noisy, which limits their direct usability for automated analysis and reasoning. Cybersecurity Knowledge Graphs (CSKGs) provide a structured representation of adversarial entities, actions, and relations, but constructing such graphs from free-text CTI remains a challenge. Recent approaches rely on monolithic Large Language Models (LLMs) to perform end-to-end extraction and completion, leading to high cost, limited controllability, and unstable performance. This paper introduces TACTIC-KG, an agentic framework for CSKG construction that decomposes the task into modular, specialized LLM agents responsible for extraction, typing, verification, and curation. Using lightweight models (3B--8B), TACTIC-KG improves stability, recall, and graph consistency while reducing deployment cost. We implement and evaluate TACTIC-KG against recent state-of-the-art systems. Experiments on human-annotated CTI reports show that agent specialization consistently outperforms larger monolithic in-context-learning (ICL) baselines in extraction F1-score, typing accuracy, and structural graph similarity.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 27 of its 41 references that are in the map. First posted on arXiv 6 Jul 2026.

Builds on

27 of 41 references.

References · 27

  1. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  2. 2025Qwen3 Technical Reportcited by 8,820
  3. 2025gpt-oss-120b & gpt-oss-20b Model Cardcited by 1,386
  4. 2026GLM-5: from Vibe Coding to Agentic Engineeringcited by 587
  5. 2025Kimi K2: Open Agentic Intelligencecited by 567
  6. 2025Agentic Context Engineering: Evolving Contexts for Self-Improving Language Modelscited by 398
  7. 2023Larger language models do in-context learning differentlycited by 394
  8. 2024Many-Shot In-Context Learningcited by 206
  9. 2024LoRA vs Full Fine-tuning: An Illusion of Equivalencecited by 109
  10. 2025Nemotron 3 Nano: Open, Efficient Mixture-of-Experts Hybrid Mamba-Transformer Model for Agentic Reasoningcited by 104
  11. 2021AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reportscited by 31
  12. 2022Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTIcited by 27
15 more
  1. 2025Devstral: Fine-tuning Language Models for Coding Agent Applicationscited by 24
  2. 2025Llama-3.1-FoundationAI-SecurityLLM-8B-Instruct Technical Reportcited by 23
  3. 2023Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wildcited by 15
  4. 2024Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Modelscited by 14
  5. 2024CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Modelscited by 14
  6. 2020Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligencecited by 12
  7. 2023Knowledge Graph Embedding: An Overviewcited by 10
  8. 2020MALOnt: An Ontology for Malware Threat Intelligencecited by 8
  9. 2023Advancing TTP Analysis: Harnessing the Power of Large Language Models with Retrieval Augmented Generationcited by 8
  10. 2025ATOM: AdapTive and OptiMized dynamic temporal knowledge graph construction using LLMscited by 7
  11. 2024LLMChain: Blockchain-based Reputation System for Sharing and Evaluating Large Language Modelscited by 6
  12. 2024CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reportscited by 5
  13. 2025CTI-HAL: A Human-Annotated Dataset for Cyber Threat Intelligence Analysiscited by 5
  14. 2024Semantic Ranking for Automated Adversarial Technique Annotation in Security Textcited by 4
  15. 2023kNN-ICL: Compositional Task-Oriented Parsing Generalization with Nearest Neighbor In-Context Learningcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Ranked by the Matcher: A Reproducibility Audit of Knowledge Graph Extraction from Threat Reportscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence
  2. 2026Beyond RAG for Cyber Threat Intelligence: A Systematic Evaluation of Graph-Based and Agentic Retrieval
  3. 2025AttackSeqBench: Benchmarking the Capabilities of LLMs for Attack Sequences Understanding
  4. 2026GRID: Graph Representation of Intelligence Data for Security Text Knowledge Graph Construction
  5. 2025CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligence
  6. 2024Crimson: Empowering Strategic Reasoning in Cybersecurity through Large Language Models
  7. 2025DefenderBench: A Toolkit for Evaluating Language Agents in Cybersecurity Environments
  8. 2025CRAKEN: Cybersecurity LLM Agent with Knowledge-Based Execution