SOC Practitioners on LLMs: Chasing Ghosts, Missing Attacks
Twenty-five SOC analysts sat down with researchers this year and delivered a verdict most vendors are not repeating on stage: large language models are useful for the boring half of the job, and unsafe for the interes…
SOC Practitioners on LLMs: Chasing Ghosts, Missing Attacks
Twenty-five SOC analysts sat down with researchers this year and delivered a verdict most vendors are not repeating on stage: large language models are useful for the boring half of the job, and unsafe for the interesting half. The empirical study grouped 15 real LLM use cases into six functional categories, and the pattern is uncomfortable — the tasks that ship confidently are the tasks nobody wanted to do anyway.
Where LLMs earn their seat
Report drafting. Ticket summarization. Alert deduplication paraphrasing. Playbook-to-English translation for junior analysts. These are the wins the interviewees cited, and they map cleanly to what NIST calls “documentation burden” in the incident response lifecycle (NIST SP 800-61r3). None of them are close to the analytic core of a Tier 2 or Tier 3 investigation.
That distinction matters for procurement. The EU NIS2 Directive obliges essential and important entities to demonstrate an effective incident-handling capability — not an effective report-writing capability. ENISA’s 2024 threat landscape reiterates that mean-time-to-detect remains the load-bearing metric (ENISA Threat Landscape 2024). If LLMs shave 40 minutes off end-of-shift paperwork but add zero seconds to detection, the regulator will not credit them.
soc_llm_scope:
allowed:
- alert_summarization
- ticket_draft_generation
- playbook_translation_en_ro
human_required:
- incident_scoping
- lateral_movement_hypothesis
- containment_authorization
audit_retention_days: 365Why incident analysis stays human
The interviewed practitioners were blunt about three limits: shallow technical depth, missing enterprise context, and the model’s inability to know which subnet hosts the finance app that cannot go down at month-end. That third one is not a model problem. It is an organizational-knowledge problem, and no fine-tune fixes it without a durable, queryable memory of the estate. Our AEGIS practice treats that memory as a first-class artifact — same rigor we apply on the retrieval side.
The second concern the study surfaced is over-reliance. When an LLM confidently paraphrases an alert, analysts stop clicking through to the raw log. MITRE’s ATT&CK evaluations have shown that missed detections cluster around alerts that looked routine (MITRE ATT&CK Evaluations). A polished summary is exactly the surface on which routine-looking becomes invisible.
Where CAI Technology sits
We deploy LLMs into SOC workflows only where the output is reversible, auditable, and consumed by a human within one shift. Anything touching containment, credential revocation, or client notification stays behind an explicit approval gate — a position aligned with ANSPDCP guidance on automated processing under GDPR Art. 22 (ANSPDCP). The interesting engineering is not making the model smarter. It is making the boundary between the model and the incident room legible enough that a regulator, an auditor, and a tired analyst at 03:00 all read it the same way.
If you are scoping an LLM pilot for your SOC this quarter, start with an AEGIS discovery conversation.