---
title: "Automating Attack Graph Construction for Agentic Pentesting. Towards Neuro-Symbolic Vulnerability Hunting (arXiv:2609.15523) | Papers With Code Cyber"
description: "Logic attack graphs grounded in scanner output provide explicit and auditable attack path reasoning LLM-based agents lack. Integrating symbolic frameworks such as MulVAL to…"
canonical: "https://paperswithcode-cyber.com/paper/2609.15523"
type: "paper"
---

# Automating Attack Graph Construction for Agentic Pentesting\. Towards Neuro\-Symbolic Vulnerability Hunting

arXiv:2609\.15523 · 2026-09-14

Authors: Oliver Stevanovic, Jasmin Wachter

## Abstract

Logic attack graphs grounded in scanner output provide explicit and auditable attack path reasoning LLM\-based agents lack\. Integrating symbolic frameworks such as MulVAL to contemporary security workflows or agentic pipelines, however, requires translating scanner evidence to initial facts, and creating domain\-specific rules\. We present a semi\-automated pipeline that addresses this interoperability problem and depict its feasibility in a web\-security case study\. Our pipeline parses findings from Trivy, Semgrep, and Nmap into MulVAL predicates and uses an LLM\-assisted process to construct domain\-specific Datalog rules linking scanner\-detectable evidence to attack techniques\. MulVAL/XSB then performs symbolic inference to generate structured attack paths\. We evaluate the attack\-graph construction infrastructure on 54 web Capture\-the\-Flag tasks from CyBench within an agentic pipeline \(Hybrid Reasoner\); we do not evaluate the performance of the downstream agent\. Every task produced at least one goal\-reaching graph, and we achieve mean ground\-truth vulnerability coverage of 53\.7%, with 51\.9% achieving full coverage; mean noise\-path rate was 83\.9%\. With median end\-to\-end time of 24\.9 s \(MulVAL reasoning: 2\.7 s\) the pipeline is feasible and runtime\-practical for agentic workflows, but predicate coverage, rule coverage, and path precision remain limiting factors\. Next steps include semantic rule validation and agent\-level comparison for graph\-guided pentesting\.

## Tasks

- [Penetration testing](https://paperswithcode-cyber.com/tasks/cyberintel-penetration-testing)

## Code repositories

- [JasminWachter/Hydra](https://github.com/JasminWachter/Hydra)

## Paper resources

- [Abstract page](https://arxiv.org/abs/2609.15523v1)
- [PDF](https://arxiv.org/pdf/2609.15523v1.pdf)