AgenticVM: Agentic AI for Adaptive Software Vulnerability Management

As software systems grow in complexity, vulnerability management faces increasing challenges due to high alert volumes, fragmented tools, and manual triage processes. This paper presents AgenticVM, an engineering-focused multi-agent system that integrates large language models with security tools to automate vulnerability aggregation, enrichment, prioritisation, and reporting. Across four evaluation scenarios, AgenticVM reduces raw scanner outputs into compact actionable queues, achieving up to 98% alert reduction (e.g., from 3,983 findings to 82 high-priority items), while predicting missing CVSS attributes with 89.3% accuracy. These results demonstrate improved prioritisation and reduced analyst workload without compromising risk coverage. We further distil key engineering lessons on agent decomposition, tool–LLM boundaries, failure containment, observability, and human-in-the-loop governance. Overall, AgenticVM shows that agentic architectures can enable scalable, coordinated, and practical vulnerability management while providing actionable design guidance for AI-enabled cybersecurity systems.