arXiv：cs.AI· Jonas Thurner, Nadine Jost, Stefan Albert Horstmann, Fabian Ising, Lea Groeber, Alena Naiakshina, Sebastian Schinzel·· 6 小时前
SOC 从业者如何看待 LLM 集成：25 场访谈揭示 15 个用例与落地障碍
From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness
AI 导读
一项针对 25 名有 LLM 使用经验的 SOC 从业者的半结构化访谈研究，整理出 15 个 LLM 用例并归为六类功能。受访者认可 LLM 在报告自动化等重复性低级任务上的价值，但认为事件分析等高影响任务尚不可行，瓶颈更多在 SOC 自身的准备程度和导致过度依赖的人为因素。尽管存在担忧，从业者仍表现出强烈的采用意愿，并提到竞争压力使其别无选择。
正文
Abstract:Security Operations Centers (SOCs) process large volumes of security events, requiring analysts to accurately detect and assess ongoing cyberattacks under time pressure. Recent advances in Large Language Models (LLMs) suggest potential benefits for security operations, yet their practical suitability for real-world SOC workflows remains poorly understood. To address this gap, we conducted 25 semi-structured interviews with SOC practitioners who had prior experience with LLMs, complemented by interactive scenarios to anticipate challenges and identify opportunities for the responsible integration of LLM-based tools into SOC workflows. We identified 15 LLM use cases grouped into six functional categories. While LLMs are valued for automating repetitive, low-level tasks such as report automation, practitioners rate high-impact tasks such as incident analysis as not yet feasible, reporting limitations in technical depth, context awareness, and organization-specific knowledge. They locate these limitations less in the models than in the readiness of their SOCs and human factors driving over-reliance. Despite concerns, practitioners express a strong willingness to adopt LLMs, describing competitive pressure that leaves few alternatives. This work contributes an empirical, practitioner-driven analysis of LLM use across SOC roles and organizations and derives concrete design and integration requirements for human-centered, operationally safe LLM-assisted security operations.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Human-Computer Interaction (cs.HC) |
| Cite as: | arXiv:2608.00672 [cs.CR] |
| (or arXiv:2608.00672v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2608.00672 arXiv-issued DOI via DataCite |
Submission history
From: Jonas Thurner [view email]
[v1]
Sat, 1 Aug 2026 13:47:44 UTC (997 KB)
[v2]
Mon, 12 Oct 2026 12:50:32 UTC (5,103 KB)
来源：arXiv：cs.AI · arxiv.org