Digital-Twin Incident Response Splits Planning From Execution, Cutting Recovery Time 15.1% and Raising Recovery Rate 33.6% Over Frontier LLM Baselines

arXiv 2608.02422·medium signalXBlueskyLinkedInCopy link

Rather than repeatedly invoking an LLM to generate a full response plan — unreliable and horizon-limited because of hallucination — this system uses a rollout planner to compute a tactical-scale strategy allocating security resources, then has a lightweight LLM agent translate it into executable commands at the operational scale. A digital twin supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios the approach reduces recovery execution time by 15.1% on average and increases recovery rate by 33.6% versus frontier LLM baselines.