Autonomous SOC: A Multi-Agent LLM Architecture for Real-Time Cybersecurity Operations in Resource-Constrained Environments

Security Operations Centers (SOCs) are critical infrastructure for cybersecurity defense, yet remain financially and operationally inaccessible to small and medium businesses (SMBs). We present VRadar, a novel multi-agent autonomous SOC architecture that leverages Large Language Models (LLMs) to replace traditional human-operated SOC workflows. Our system deploys five specialized AI agents — Operator, Care, Monitor, Optimizer, and Marketing — that work concurrently to perform alert triage, incident response, infrastructure monitoring, automated defense, and stakeholder communication. We evaluate our architecture on a production deployment processing 1.35 million security alerts across 11 tenants over 34 days, demonstrating that the multi-agent system achieves a 91% autonomous resolution rate with an average confidence of 87.5%, while reducing operational costs by approximately 97% compared to human-staffed SOC equivalents.