Large Language Models in Cybersecurity: State-of-the-Art
Not on the map. Why?
Abstract (arXiv)
The rise of Large Language Models (LLMs) has revolutionized our comprehension of intelligence bringing us closer to Artificial Intelligence. Since their introduction, researchers have actively explored the applications of LLMs across diverse fields, significantly elevating capabilities. Cybersecurity, traditionally resistant to data-driven solutions and slow to embrace machine learning, stands out as a domain. This study examines the existing literature, providing a thorough characterization of both defensive and adversarial applications of LLMs within the realm of cybersecurity. Our review not only surveys and categorizes the current landscape but also identifies critical research gaps. By evaluating both offensive and defensive applications, we aim to provide a holistic understanding of the potential risks and opportunities associated with LLM-driven cybersecurity.
Key facts. Cited by 34 papers in the map (data through 7 Oct 2026). Builds on 54 of its 102 references that are in the map. First posted on arXiv 30 Jan 2024.
Builds on
54 of 102 references.
References · 54
- 2017Attention Is All You Needcited by 59,932
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2023A Survey of Large Language Modelscited by 2,537
- 2019Megatron-LM: Training Multi-Billion Parameter Language Models Using Model Parallelismcited by 1,829
- 2023WizardLM: Empowering large pre-trained language models to follow complex instructionscited by 1,116
- 2022GLM-130B: An Open Bilingual Pre-trained Modelcited by 837
- 2023A Comprehensive Overview of Large Language Modelscited by 639
- 2022Towards Reasoning in Large Language Models: A Surveycited by 593
- 2023Harnessing the Power of LLMs in Practice: A Survey on ChatGPT and Beyondcited by 409
- 2020Med-BERT: pre-trained contextualized embeddings on large-scale structured electronic health records for disease predictioncited by 368
- 2023A Comprehensive Survey on Pretrained Foundation Models: A History from BERT to ChatGPTcited by 364
38 more
- 2023HuaTuo: Tuning LLaMA Model with Chinese Medical Knowledgecited by 161
- 2023In-Context Impersonation Reveals Large Language Models' Strengths and Biasescited by 154
- 2023Large Language Models for Code: Security Hardening and Adversarial Testingcited by 149
- 2021Examining Zero-Shot Vulnerability Repair with Large Language Modelscited by 105
- 2023PentestGPT: An LLM-empowered Automatic Penetration Testing Toolcited by 94
- 2023XuanYuan 2.0: A Large Chinese Financial Chat Model with Hundreds of Billions Parameterscited by 92
- 2022Lost at C: A User Study on the Security Implications of Large Language Model Code Assistantscited by 87
- 2023Goat: Fine-tuned LLaMA Outperforms GPT-4 on Arithmetic Taskscited by 84
- 2023Getting pwn'd by AI: Penetration Testing with Large Language Modelscited by 82
- 2023Large Language Models for Supply Chain Optimizationcited by 61
- 2022SecureBERT: A Domain-Specific Language Model for Cybersecuritycited by 60
- 2023Automating Customer Service using LangChain: Building custom open-source GPT Chatbot for organizationscited by 59
- 2022AlexaTM 20B: Few-Shot Learning Using a Large-Scale Multilingual Seq2Seq Modelcited by 57
- 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
- 2023MusiLingo: Bridging Music and Text with Pre-trained Language Models for Music Captioning and Query Responsecited by 45
- 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 43
- 2023A New Era in Software Security: Towards Self-Healing Software via Large Language Models and Formal Verificationcited by 42
- 2023When ChatGPT Meets Smart Contract Vulnerability Detection: How Far Are We?cited by 42
- 2023Do you still need a manual smart contract audit?cited by 34
- 2023CPLLM: Clinical Prediction with Large Language Modelscited by 34
- 2022CySecBERT: A Domain-Adapted Language Model for the Cybersecurity Domaincited by 31
- 2023From Text to MITRE Techniques: Exploring the Malicious Use of Large Language Models for Generating Cyber Attack Payloadscited by 31
- 2023How Useful are Educational Questions Generated by Large Language Models?cited by 23
- 2023Using Large Language Models for Cybersecurity Capture-The-Flag Challenges and Certification Questionscited by 23
- 2022Targeted Phishing Campaigns using Large Scale Language Modelscited by 22
- 2023Decoding the Threat Landscape : ChatGPT, FraudGPT, and WormGPT in Social Engineering Attackscited by 22
- 2023LLM in the Shell: Generative Honeypotscited by 19
- 2023Balancing Specialized and General Skills in LLMs: The Impact of Modern Tuning and Data Strategycited by 18
- 2023RatGPT: Turning online LLMs into Proxies for Malware Attackscited by 17
- 2023Generating Phishing Attacks using ChatGPTcited by 14
- 2023Fundamentals of Generative Large Language Models and Perspectives in Cyber-Defensecited by 13
- 2023Reformulating Domain Adaptation of Large Language Models as Adapt-Retrieve-Revise: A Case Study on Chinese Legal Domaincited by 12
- 2023Chatbots in a Honeypot Worldcited by 9
- 2023Detecting Phishing Sites Using ChatGPTcited by 9
- 2018Generative Models for Spear Phishing Posts on Social Mediacited by 8
- 2023Scamming the Scammers: Using ChatGPT to Reply Mails for Wasting Time and Resourcescited by 8
- 2023Impacts and Risk of Generative AI Technology on Cyber Defensecited by 8
- 2023Web Content Filtering through knowledge distillation of Large Language Modelscited by 7
50 most cited of 54 All 54 (JSON)
Built on by
Citing papers per year: 2024: 11; 2025: 19; 2026: 4.
34 papers.
Sort:
By area:
- 2024When LLMs Meet Cybersecurity: A Systematic Literature Reviewcited by 70
- 2024Large Language Models for Cyber Security: A Systematic Literature Reviewcited by 65
- 2024HackSynth: LLM Agent and Evaluation Framework for Autonomous Penetration Testingcited by 35
- 2025Llama-3.1-FoundationAI-SecurityLLM-8B-Instruct Technical Reportcited by 21
- 2024ProFLingo: A Fingerprinting-based Intellectual Property Protection Scheme for Large Language Modelscited by 15
- 2025CyberRAG: An Agentic RAG cyber attack classification and reporting toolcited by 11
- 2024Transfer Learning in Pre-Trained Large Language Models for Malware Detection Based on System Callscited by 8
- 2024Distributed Threat Intelligence at the Edge Devices: A Large Language Model-Driven Approachcited by 6
- 2025A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomycited by 6
- 2024BreachSeek: A Multi-Agent Automated Penetration Testercited by 5
- 2024CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Researchcited by 5
- 2025Can Language Models Falsify? Evaluating Algorithmic Reasoning with Counterexample Creationcited by 5
22 more
- 2024Large Multimodal Agents for Accurate Phishing Detection with Enhanced Token Optimization and Cost Reductioncited by 4
- 2025SpecPipe: Accelerating Pipeline Parallelism-based LLM Inference with Speculative Decodingcited by 4
- 2024HULLMI: Human vs LLM identification with explainabilitycited by 3
- 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Promptingcited by 3
- 2025AutoBnB-RAG: Enhancing Multi-Agent Incident Response with Retrieval-Augmented Generationcited by 3
- 2025Toward Cybersecurity-Expert Small Language Modelscited by 3
- 2025SoK: Are Watermarks in LLMs Ready for Deployment?cited by 2
- 2025Securing Educational LLMs: A Generalised Taxonomy of Attacks on LLMs and DREAD Risk Assessmentcited by 2
- 2025Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generationcited by 2
- 2025The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelinescited by 2
- 2024Psychological Profiling in Cybersecurity: A Look at LLMs and Psycholinguistic Featurescited by 1
- 2025Trustworthy GNNs with LLMs: A Systematic Review and Taxonomycited by 1
- 2025Vulnerability Mitigation System (VMS): LLM Agent and Evaluation Framework for Autonomous Penetration Testingcited by 1
- 2026LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operationscited by 1
- 2026Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agentscited by 1
- 2025Beyond Trusting Trust: Multi-Model Validation for Robust Code Generationcited by 0
- 2025How Good LLM-Generated Password Policies Are?cited by 0
- 2025CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimizationcited by 0
- 2025From Capabilities to Performance: Evaluating Key Functional Properties of LLM Architectures in Penetration Testingcited by 0
- 2025CLASP: Cost-Optimized LLM-based Agentic System for Phishing Detectioncited by 0
- 2026SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Trainingcited by 0
- 2026When Prompts Become Payloads: A Framework for Mitigating SQL Injection Attacks in Large Language Model-Driven Applicationscited by 0
- 2026Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agents4 Aug 2026
- 2026When Prompts Become Payloads: A Framework for Mitigating SQL Injection Attacks in Large Language Model-Driven Applications11 May 2026
- 2026SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Training8 Apr 2026
- 2026LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations7 Apr 2026
- 2025The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines7 Dec 2025
- 2025Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generation31 Oct 2025
- 2025CLASP: Cost-Optimized LLM-based Agentic System for Phishing Detection21 Oct 2025
- 2025Toward Cybersecurity-Expert Small Language Models15 Oct 2025
- 2025From Capabilities to Performance: Evaluating Key Functional Properties of LLM Architectures in Penetration Testing16 Sep 2025
- 2025AutoBnB-RAG: Enhancing Multi-Agent Incident Response with Retrieval-Augmented Generation18 Aug 2025
- 2025Securing Educational LLMs: A Generalised Taxonomy of Attacks on LLMs and DREAD Risk Assessment12 Aug 2025
- 2025Llama-3.1-FoundationAI-SecurityLLM-8B-Instruct Technical Report1 Aug 2025
22 more
- 2025CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization1 Aug 2025
- 2025Vulnerability Mitigation System (VMS): LLM Agent and Evaluation Framework for Autonomous Penetration Testing14 Jul 2025
- 2025CyberRAG: An Agentic RAG cyber attack classification and reporting tool3 Jul 2025
- 2025How Good LLM-Generated Password Policies Are?10 Jun 2025
- 2025SoK: Are Watermarks in LLMs Ready for Deployment?5 Jun 2025
- 2025A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy29 May 2025
- 2025SpecPipe: Accelerating Pipeline Parallelism-based LLM Inference with Speculative Decoding5 Apr 2025
- 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting5 Mar 2025
- 2025Can Language Models Falsify? Evaluating Algorithmic Reasoning with Counterexample Creation26 Feb 2025
- 2025Beyond Trusting Trust: Multi-Model Validation for Robust Code Generation22 Feb 2025
- 2025Trustworthy GNNs with LLMs: A Systematic Review and Taxonomy12 Feb 2025
- 2024Large Multimodal Agents for Accurate Phishing Detection with Enhanced Token Optimization and Cost Reduction3 Dec 2024
- 2024HackSynth: LLM Agent and Evaluation Framework for Autonomous Penetration Testing2 Dec 2024
- 2024CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research2 Nov 2024
- 2024HULLMI: Human vs LLM identification with explainability7 Sep 2024
- 2024BreachSeek: A Multi-Agent Automated Penetration Tester31 Aug 2024
- 2024Psychological Profiling in Cybersecurity: A Look at LLMs and Psycholinguistic Features26 Jun 2024
- 2024Transfer Learning in Pre-Trained Large Language Models for Malware Detection Based on System Calls15 May 2024
- 2024Distributed Threat Intelligence at the Edge Devices: A Large Language Model-Driven Approach14 May 2024
- 2024Large Language Models for Cyber Security: A Systematic Literature Review8 May 2024
- 2024When LLMs Meet Cybersecurity: A Systematic Literature Review6 May 2024
- 2024ProFLingo: A Fingerprinting-based Intellectual Property Protection Scheme for Large Language Models3 May 2024
- 2024HackSynth: LLM Agent and Evaluation Framework for Autonomous Penetration Testingcited by 35
- 2024BreachSeek: A Multi-Agent Automated Penetration Testercited by 5
- 2024Large Multimodal Agents for Accurate Phishing Detection with Enhanced Token Optimization and Cost Reductioncited by 4
- 2025The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelinescited by 2
- 2025Vulnerability Mitigation System (VMS): LLM Agent and Evaluation Framework for Autonomous Penetration Testingcited by 1
- 2026LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operationscited by 1
- 2026Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agentscited by 1
- 2025CLASP: Cost-Optimized LLM-based Agentic System for Phishing Detectioncited by 0
- 2026Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agents4 Aug 2026
- 2026LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations7 Apr 2026
- 2025The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines7 Dec 2025
- 2025CLASP: Cost-Optimized LLM-based Agentic System for Phishing Detection21 Oct 2025
- 2025Vulnerability Mitigation System (VMS): LLM Agent and Evaluation Framework for Autonomous Penetration Testing14 Jul 2025
- 2024Large Multimodal Agents for Accurate Phishing Detection with Enhanced Token Optimization and Cost Reduction3 Dec 2024
- 2024HackSynth: LLM Agent and Evaluation Framework for Autonomous Penetration Testing2 Dec 2024
- 2024BreachSeek: A Multi-Agent Automated Penetration Tester31 Aug 2024
- 2025SoK: Are Watermarks in LLMs Ready for Deployment?cited by 2
- 2025Securing Educational LLMs: A Generalised Taxonomy of Attacks on LLMs and DREAD Risk Assessmentcited by 2
- 2026When Prompts Become Payloads: A Framework for Mitigating SQL Injection Attacks in Large Language Model-Driven Applicationscited by 0
- 2026When Prompts Become Payloads: A Framework for Mitigating SQL Injection Attacks in Large Language Model-Driven Applications11 May 2026
- 2025Securing Educational LLMs: A Generalised Taxonomy of Attacks on LLMs and DREAD Risk Assessment12 Aug 2025
- 2025SoK: Are Watermarks in LLMs Ready for Deployment?5 Jun 2025
- 2024When LLMs Meet Cybersecurity: A Systematic Literature Reviewcited by 70
- 2024Large Language Models for Cyber Security: A Systematic Literature Reviewcited by 65
- 2025Llama-3.1-FoundationAI-SecurityLLM-8B-Instruct Technical Reportcited by 21
- 2024ProFLingo: A Fingerprinting-based Intellectual Property Protection Scheme for Large Language Modelscited by 15
- 2024Transfer Learning in Pre-Trained Large Language Models for Malware Detection Based on System Callscited by 8
- 2024Distributed Threat Intelligence at the Edge Devices: A Large Language Model-Driven Approachcited by 6
- 2025A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomycited by 6
- 2024CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Researchcited by 5
- 2024HULLMI: Human vs LLM identification with explainabilitycited by 3
- 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Promptingcited by 3
- 2025Toward Cybersecurity-Expert Small Language Modelscited by 3
- 2024Psychological Profiling in Cybersecurity: A Look at LLMs and Psycholinguistic Featurescited by 1
12 most cited of 18 All 18 (JSON)
- 2026SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Training8 Apr 2026
- 2025Toward Cybersecurity-Expert Small Language Models15 Oct 2025
- 2025From Capabilities to Performance: Evaluating Key Functional Properties of LLM Architectures in Penetration Testing16 Sep 2025
- 2025Llama-3.1-FoundationAI-SecurityLLM-8B-Instruct Technical Report1 Aug 2025
- 2025CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization1 Aug 2025
- 2025How Good LLM-Generated Password Policies Are?10 Jun 2025
- 2025A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy29 May 2025
- 2025OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting5 Mar 2025
- 2025Beyond Trusting Trust: Multi-Model Validation for Robust Code Generation22 Feb 2025
- 2025Trustworthy GNNs with LLMs: A Systematic Review and Taxonomy12 Feb 2025
- 2024CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research2 Nov 2024
- 2024HULLMI: Human vs LLM identification with explainability7 Sep 2024
12 newest of 18 All 18 (JSON)