BlueSTAR runs tiered autonomous cyber defense on two live enterprise IT/OT ranges

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2609.11852 (2026-09-10) addresses the fact that raw security telemetry arrives faster than an LLM can read it, that single events are ambiguous, and that unconstrained LLM actions carry operational risk. BlueSTAR first compresses high-volume telemetry into compact indicators of compromise, then reasons over those, and introduces a resilience metric that jointly scores attacker reach, impact on mission-critical assets, and the disruption caused by the defense itself. It was evaluated on two live enterprise IT/OT cyber ranges against seven attack chains built from real intrusion techniques, retaining the fast containment of deterministic playbooks.