The paper presents CyberAId, a hybrid multi-agent AI platform designed to enhance cybersecurity for European financial institutions under regulatory frameworks like DORA, NIS2, and the EU AI Act. The core argument is that current security operations are limited by reasoning capacity, not data or staffing, and that narrow LLM wins on isolated tasks do not constitute a deployable platform. CyberAId addresses this by combining specialist LLM subagents with classical SIEM/XDR telemetry, ensuring high-throughput ingestion and deterministic detection while leveraging LLMs for cross-domain synthesis, regulatory mapping, and natural-language interaction.

The platform features a Main Agent/CRA coordination layer, a Reporting capability, and eight specialist agents (Threat Intelligence, Vulnerability Assessment, Compliance Verification, Behavioural Analysis, Incident Response, Forensic Analysis, DevSecOps/Code Analysis). It operates under bounded human-in-the-loop autonomy with three tiers of escalation, and incorporates partitioned RAG, federated cross-institutional knowledge sharing, and optional capability packs including digital twin adversarial validation, eBPF kernel telemetry, and quantum token authentication. The system is validated across four financial use cases: client impersonation, anti-money laundering, retail banking incident response, and high-frequency trading resilience. The paper identifies skill-based agent adaptation as the most promising research direction for continuously refining collective defence across deployments.