# A Knowledge-Based Multi-Agent Framework for Security Control Recommendation

arXiv: https://arxiv.org/abs/2607.09954 · HTML: https://mlsanity.com/paper/2607.09954/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 57 references that are in the map.
- First posted on arXiv 10 Jul 2026.

## Builds on (most cited first, 9 of 9)

- [Graphical Models for Game Theory](https://mlsanity.com/paper/1301.2281/) (2013)
- [Reasoning about Causality in Games](https://mlsanity.com/paper/2301.02324/) (2023)
- [Equilibrium Refinements for Multi-Agent Influence Diagrams: Theory and Practice](https://mlsanity.com/paper/2102.05008/) (2021)
- [A Cybersecurity Risk Analysis Framework for Systems with Artificial Intelligence Components](https://mlsanity.com/paper/2401.01630/) (2024)
- [A Game-Theoretic Approach for Security Control Selection](https://mlsanity.com/paper/2410.22762/) (2024)
- [A Taxonomy of Functional Security Features and How They Can Be Located](https://mlsanity.com/paper/2501.04454/) (2025)
- [The Complexity of Correlated Equilibria in Generalized Games](https://mlsanity.com/paper/2506.01899/) (2025)
- [Multi-Agent Influence Diagrams to Hybrid Threat Modeling](https://mlsanity.com/paper/2603.03526/) (2026)
- [A Bayesian Network Approach for Enhancing Security-Focused Decision Support Systems](https://mlsanity.com/paper/2606.10782/) (2026)

## Abstract (arXiv)

Hardening IT on-premises environments can be a daunting task for teams without access to adequate cybersecurity expertise. In this regard, Decision Support Systems (DSS) with embedded expert knowledge can assist users by guiding them with security recommendations to meet their objectives. This work proposes a Security DSS that recommends security control sub-families given minimal user requirements indicating coverage of different security dimensions. It leverages a curated, unified dataset from both well-known Information Security (InfoSec) and academic sources. This DSS is defined as a non-zero-sum, simultaneous game that is grounded in a Multi-Agent Influence Diagram (MAID) model and explores the decision space over 7 security dimensions or agents, using no-regret online learning to ultimately find the security control sub-families that best fit the requirements while incurring minimal under- and over-provisioning of security resources. This work was validated in terms of performance and accuracy, among others, for varying dataset sizes. It shows exceptional satisfaction coverage results of 99% when using as little as ~65% of the SW-implementable security controls, running in 1.2-35.7 seconds; and more moderate coverage results of 73%-77% when using ~29% of the controls, resolving in 0.8-13.8 seconds.