Sentinel-RL splits network graph analysis from language tasks for faster security responses.

Security teams use AI to catch hackers inside company networks. But large language models struggle here. They cannot fit huge computer networks into their memory limits, and they can make up actions that do not match the real network map. Researchers built Sentinel-RL to fix this. Instead of letting the language model handle the whole network, a specialized graph tool compresses live computer connections into a small snapshot. Next, a reinforcement learning program picks containment actions from a strict, safe list. The language model only turns those actions into readable reports for human analysts. The team tested it on real security data. First, their setup loads a 24M-edge network roughly 24x faster than standard setups. Second, it flags fast attacks in <=2.5 s across 50 trials. Finally, the full system spots threats, investigates, and prepares a recommendation for a human to approve in a median of 6.3 s.

Why it matters

Enterprises using AI security agents struggle because networks are too large and AI can make risky suggestions. This system makes AI agents reliable by splitting the work, allowing faster containment of threats.

Questions answered