https://arxiv.org/abs/2604.12040

Skip to main content
Cornell University
Learn about arXiv becoming an independent nonprofit.
We gratefully acknowledge support from the Simons Foundation, member
institutions, and all contributors. Donate
 
arxiv logo > cs > arXiv:2604.12040
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv logo
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Cryptography and Security

arXiv:2604.12040 (cs)
[Submitted on 13 Apr 2026]

Title:SIR-Bench: Evaluating Investigation Depth in Security Incident
Response Agents

Authors:Daniel Begimher, Cristian Leo, Jack Huang, Pat Gaw, Bonan
Zheng
View a PDF of the paper titled SIR-Bench: Evaluating Investigation
Depth in Security Incident Response Agents, by Daniel Begimher and 4
other authors
View PDF HTML (experimental)

    Abstract:We present SIR-Bench, a benchmark of 794 test cases for
    evaluating autonomous security incident response agents that
    distinguishes genuine forensic investigation from alert
    parroting. Derived from 129 anonymized incident patterns with
    expert-validated ground truth, SIR-Bench measures not only
    whether agents reach correct triage decisions, but whether they
    discover novel evidence through active investigation. To
    construct SIR-Bench, we develop Once Upon A Threat (OUAT), a
    framework that replays real incident patterns in controlled cloud
    environments, producing authentic telemetry with measurable
    investigation outcomes. Our evaluation methodology introduces
    three complementary metrics: triage accuracy (M1), novel finding
    discovery (M2), and tool usage appropriateness (M3), assessed
    through an adversarial LLM-as-Judge that inverts the burden of
    proof -- requiring concrete forensic evidence to credit
    investigations. Evaluating our SIR agent on the benchmark
    demonstrates 97.1% true positive (TP) detection, 73.4% false
    positive (FP) rejection, and 5.67 novel key findings per case,
    establishing a baseline against which future investigation agents
    can be measured.

Comments: 9 pages, 6 tables, 1 figure. Equal contribution by first
          three authors
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence
          (cs.AI); Software Engineering (cs.SE)
Cite as:  arXiv:2604.12040 [cs.CR]
          (or arXiv:2604.12040v1 [cs.CR] for this version)
          https://doi.org/10.48550/arXiv.2604.12040
          Focus to learn more
          arXiv-issued DOI via DataCite (pending registration)

Submission history

From: Daniel Begimher [view email]
[v1] Mon, 13 Apr 2026 20:32:03 UTC (12 KB)
Full-text links:

Access Paper:

    View a PDF of the paper titled SIR-Bench: Evaluating
    Investigation Depth in Security Incident Response Agents, by
    Daniel Begimher and 4 other authors
  * View PDF
  * HTML (experimental)
  * TeX Source

view license
Current browse context:
cs.CR
< prev   |   next >
new | recent | 2026-04
Change to browse by:
cs
cs.AI
cs.SE

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

export BibTeX citation Loading...

BibTeX formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Reddit logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
[ ] scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
( ) Code, Data, Media

Code, Data and Media Associated with this Article

[ ] alphaXiv Toggle
alphaXiv (What is alphaXiv?)
[ ] Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
[ ] DagsHub Toggle
DagsHub (What is DagsHub?)
[ ] GotitPub Toggle
Gotit.pub (What is GotitPub?)
[ ] Huggingface Toggle
Hugging Face (What is Huggingface?)
[ ] ScienceCast Toggle
ScienceCast (What is ScienceCast?)
( ) Demos

Demos

[ ] Replicate Toggle
Replicate (What is Replicate?)
[ ] Spaces Toggle
Hugging Face Spaces (What is Spaces?)
[ ] Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
( ) Related Papers

Recommenders and Search Tools

[ ] Link to Influence Flower
Influence Flower (What are Influence Flowers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)

  * Author
  * Venue
  * Institution
  * Topic

( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status