The 3nd International Workshop on Autonomous Cybersecurity (AutonomousCyber 2026)

The 3rd edition of AutonomousCyber 2026 represents a continued effort to advance research and development in autonomous cybersecurity. Following the success of our inaugural event, AutonomousCyber 2024, co-located with the 31st ACM Conference on Computer and Communications Security (ACM CCS 2024) in Salt Lake City, USA (17 submissions, 7 accepted, 37 participants), and the second edition, AutonomousCyber 2025, held at ESORICS 2025 in Toulouse, France (24 submissions, 7 accepted, 40 participants), the 2026 edition will be co-located with the 31st European Symposium on Research in Computer Security (ESORICS 2026), a premier venue for security and privacy research.
ESORICS provides a uniquely suitable forum for AutonomousCyber 2026 by bringing together a distinguished community of researchers and practitioners working across systems security, privacy, and trustworthy AI. This audience will particularly benefit from interdisciplinary discussions bridging theoretical advances and operational deployment of autonomous defense mechanisms. This edition highlights the ongoing transition from AI-assisted security tools toward fully autonomous and agent-driven cybersecurity systems. Unlike traditional automation, true autonomy in cybersecurity entails continuous learning, contextual reasoning, adaptive decision-making, and proactive threat mitigation under operational constraints. The workshop explores advances in self-reliant cybersecurity systems integrating Artificial Intelligence (AI), Machine Learning (ML), Large Language Models (LLMs), Quantum Machine Learning (QML), and Reinforcement Learning (RL) for proactive cyber defence. Particular emphasis is placed on emerging agentic AI security systems, where LLM-based reasoning, tool use, and multi-agent coordination enable security mechanisms capable of planning, acting, and adapting in real time. We further highlight the role of intelligent cyber agents in continuous assurance and operational resilience, including collaboration between autonomous agents and human operators through human–machine teaming (HMT). The workshop aims to examine how such systems can operate safely, verifiably, and responsibly while strengthening cyber resilience across modern digital infrastructures.
We, therefore, invite original, unpublished research that pushes the boundaries of AI-driven autonomous security defences. Submissions are encouraged that include comprehensive reviews, theoretical advances, experimental results, practical implementations, and case studies—each contributing novel insights and real-world validations to the field of autonomous cybersecurity. In particular, we emphasize research on systems capable of taking security actions under bounded authority, operating under policy constraints, and reasoning about consequences of defensive actions in real time. Submissions focusing solely on detection without autonomous decision-making components are outside the primary scope unless they explicitly enable autonomous operation.
At the AutonomousCyber workshop, we bring together a distinguished program committee composed of globally renowned experts and researchers in cybersecurity, ML, and AI. Our members have a proven track record of high-impact peer-reviewed publications, and their collective experience ensures a rigorous, fair, and timely evaluation process. At the heart of autonomous cybersecurity is the endeavor to establish cybersecurity systems with five main characteristics:

1. Self-improving: Unlike mere automation, autonomous cybersecurity applications can improve themselves without manual intervention, adapting to new threats and changes in the environment.
2. Continuous learning: Autonomous cybersecurity systems continuously learn from new data, making these systems more resilient and adaptable.
3. Goal-directed reasoning: Autonomous systems reason about attack progression, defense impact, and operational objectives, selecting actions that satisfy mission and safety constraints.
4. Automatic customization and personalization: Autonomous systems can tailor their responses and strategies based on specific network environments and threat models, offering a more personalized and effective approach to cybersecurity.
5. Bounded autonomy and safety: Autonomous cybersecurity systems operate under explicit policy, verification, and human-override mechanisms to ensure safe and accountable behaviour.