Governance-Aware Agentic AI for Autonomous Cyber Defense: A Simulated Tool-Use Safety and Incident-Response Evaluation

This article presents a clearly labeled simulated empirical study spanning Computer Science and Engineering. A simulated security-operations environment contained 1,200 incidents spanning phishing, malware triage, suspicious login, exposed credentials, and cloud misconfiguration. Three workflows were compared: analyst-only, unrestricted LLM agent, and governance-aware agent with scoped tools, confidence thresholds, approval gates, and audit logging. No live exploitation or real organization was involved. The governance-aware agent reduced simulated mean triage time by 46% relative to analyst-only handling while avoiding most high-impact unauthorized actions. The unrestricted agent was faster but generated substantially more unsafe tool calls and incorrect containment actions under ambiguous alerts. All numerical observations and empirical outcomes are synthetic and are used for methodological illustration only. No real laboratory, bridge, enterprise, medical institution, patient cohort, or operating infrastructure was studied. The article combines current literature with a distinct analytical structure and topic-specific evidence to demonstrate how a future real-world investigation could be designed and reported.