A Taxonomy of Agentic Systems for Software Security Detection

Abstract

Software vulnerabilities have become a recognized national-security risk, yet the volume of code and the sophistication of threats now far outpace what manual security review and the limited supply of expert security engineers can sustain. A new class of systems has emerged in response: agentic systems for software security detection, which couple large language models with planning, memory, and external tools so that they can autonomously analyze codebases, reason about program behavior, and identify, triage, and help re-mediate vulnerabilities. The field has grown rapidly but unevenly, and its terminology, capabilities, and evaluation practices remain fragmented. This paper organizes the area into a structured taxonomy along five axes: the de-tection capability targeted, the analysis paradigm employed, the agent archi-tecture, the degree of autonomy, and the evaluation methodology. We popu-late the taxonomy with representative systems, including the cyber reasoning systems demonstrated at the DARPA AI Cyber Challenge, and we use it to compare designs, surface recurring patterns, and expose gaps. We find that the strongest results combine learned reasoning with classical program analy-sis and tool use rather than relying on either alone, and that repository-scale detection, trustworthy triage, and reproducible evaluation remain the principal open challenges. The taxonomy is intended as a shared vocabulary and a roadmap for building the next generation of autonomous software-security systems.