arXiv: TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction

This publication, TACTIC-KG, introduces a novel framework for constructing Cyber Threat Intelligence (CTI) knowledge graphs using small, specialized teams of AI agents. The paper details how these agents can collaboratively automate the extraction, structuring, and linking of threat data from diverse sources, such as security reports and incident databases. While not a regulatory change itself, this research signals a significant advancement in how organizations can operationalize AI for real-time threat analysis and information sharing, which directly impacts compliance with emerging AI safety and cybersecurity frameworks.

The primary affected sectors are those managing critical infrastructure, financial services, healthcare, and any organization subject to strict cybersecurity reporting obligations under regulations like the EU's NIS2 Directive or the Digital Operational Resilience Act (DORA). Compliance teams in these sectors must recognize that such AI-driven tools will soon be expected to demonstrate transparency, accuracy, and auditability in their threat intelligence processes. The ability to trace how a knowledge graph was built and validated by AI agents will become a key compliance requirement.

Compliance teams should immediately review their current threat intelligence workflows to assess readiness for AI-augmented systems. Begin mapping how the TACTIC-KG approach aligns with your organization’s obligations for data provenance, explainability, and human oversight. Proactively engage with your cybersecurity and AI governance teams to develop validation protocols for any AI-generated threat intelligence, ensuring that outputs can be audited and that agent decisions remain within acceptable risk parameters. Finally, monitor the EU AI Act’s evolving requirements for high-risk AI systems, as such frameworks may fall under its scope.