Security in a Workflow: Exploring Role-Based Agentic Architectures for Vulnerability Handling
For software security practitioners, it explores an agentic workflow that mirrors industrial practice, but results are incremental with modest accuracy.
The paper studies a role-based agentic workflow (Planner, Analyzer, Fixer, Verifier) for vulnerability handling, achieving 44% detection accuracy and 19% fix accuracy on 25 real-world C/C++ vulnerabilities, comparable to GPT-5.5.
Secure software engineering in practice is a multi-stage workflow involving vulnerability analysis, remediation, and fix verification. However, current LLM-based software security approaches often focus on isolated tasks such as detection or patch generation, with limited attention to agentic architectures reflecting industrial workflow. This creates a gap between existing LLM-based vulnerability-handling methods and real-world practices. In this paper, we study a role-based agentic workflow for vulnerability analysis and mitigation consisting of Planner, Analyzer, Fixer, and Verifier roles. To explore the effect of static analysis tool, the analyzer agent was integrated with the CodeQL in one of the workflows. The models used include nemotron-cascade-2:30b, qwen3-coder-next, and gpt-oss:120b. Our evaluation uses 25 real-world C/C++ vulnerabilities. The study reports 44% vulnerability detection accuracy comparable to GPT 5.5 and 19% fix accuracy. We also list implications from this study in context of software security practitioners.