# A Comprehensive Overview of Large Language Models (LLMs) for Cyber Defences: Opportunities and Directions

arXiv: https://arxiv.org/abs/2405.14487 · HTML: https://mlsanity.com/paper/2405.14487/

## Key facts

- Cited by 33 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 May 2024.

## Built on by (most cited first, 30 of 33)

- [LLM-Powered AI Agent Systems and Their Applications in Industry](https://mlsanity.com/paper/2505.16120/) (2025)
- [Frontier AI's Impact on the Cybersecurity Landscape](https://mlsanity.com/paper/2504.05408/) (2025)
- [ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation](https://mlsanity.com/paper/2507.14201/) (2025)
- [Benchmarking Practices in LLM-driven Offensive Security: Testbeds, Metrics, and Experiment Design](https://mlsanity.com/paper/2504.10112/) (2025)
- [A Contemporary Survey of Large Language Model Assisted Program Analysis](https://mlsanity.com/paper/2502.18474/) (2025)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [What Do Speech Foundation Models Not Learn About Speech?](https://mlsanity.com/paper/2410.12948/) (2024)
- [The Use of Large Language Models (LLM) for Cyber Threat Intelligence (CTI) in Cybercrime Forums](https://mlsanity.com/paper/2408.03354/) (2024)
- [CIPHER: Cybersecurity Intelligent Penetration-testing Helper for Ethical Researcher](https://mlsanity.com/paper/2408.11650/) (2024)
- [Advanced Persistent Threats (APT) Attribution Using Deep Reinforcement Learning](https://mlsanity.com/paper/2410.11463/) (2024)
- [Mapping the Landscape of Generative AI in Network Monitoring and Management](https://mlsanity.com/paper/2502.08576/) (2025)
- [LLM-Assisted Proactive Threat Intelligence for Automated Reasoning](https://mlsanity.com/paper/2504.00428/) (2025)
- [Evaluating the Usability of LLMs in Threat Intelligence Enrichment](https://mlsanity.com/paper/2409.15072/) (2024)
- [Helping Large Language Models Protect Themselves: An Enhanced Filtering and Summarization System](https://mlsanity.com/paper/2505.01315/) (2025)
- [How to make Medical AI Systems safer? Simulating Vulnerabilities, and Threats in Multimodal Medical RAG System](https://mlsanity.com/paper/2508.17215/) (2025)
- [Generative AI for Internet of Things Security: Challenges and Opportunities](https://mlsanity.com/paper/2502.08886/) (2025)
- [Can LLMs Assist Computer Education? an Empirical Case Study of DeepSeek](https://mlsanity.com/paper/2504.00421/) (2025)
- [Could AI Trace and Explain the Origins of AI-Generated Images and Text?](https://mlsanity.com/paper/2504.04279/) (2025)
- [Enhancing GraphQL Security by Detecting Malicious Queries Using Large Language Models, Sentence Transformers, and Convolutional Neural Networks](https://mlsanity.com/paper/2508.11711/) (2025)
- [Differential Robustness in Transformer Language Models: Empirical Evaluation Under Adversarial Text Attacks](https://mlsanity.com/paper/2509.09706/) (2025)
- [Sentra-Guard: A Real-Time Multilingual Defense Against Adversarial LLM Prompts](https://mlsanity.com/paper/2510.22628/) (2025)
- [A Simple Architecture for Enterprise Large Language Model Applications based on Role based security and Clearance Levels using Retrieval-Augmented Generation or Mixture of Experts](https://mlsanity.com/paper/2407.06718/) (2024)
- [Towards Automatic Hands-on-Keyboard Attack Detection Using LLMs in EDR Solutions](https://mlsanity.com/paper/2408.01993/) (2024)
- [Data Processing for the OpenGPT-X Model Family](https://mlsanity.com/paper/2410.08800/) (2024)
- [Considerations Influencing Offense-Defense Dynamics From Artificial Intelligence](https://mlsanity.com/paper/2412.04029/) (2024)
- [Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques](https://mlsanity.com/paper/2507.13629/) (2025)
- [From Capabilities to Performance: Evaluating Key Functional Properties of LLM Architectures in Penetration Testing](https://mlsanity.com/paper/2509.14289/) (2025)
- [WiFiPenTester: Advancing Wireless Ethical Hacking with Governed GenAI](https://mlsanity.com/paper/2601.23092/) (2026)
- [SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Training](https://mlsanity.com/paper/2604.06900/) (2026)
- [Agentic and Generative AI for Open-Source Intelligence and Cyber Investigations: Taxonomy, Evaluation, Challenges, and Future Directions](https://mlsanity.com/paper/2607.03233/) (2026)

## Abstract (arXiv)

The recent progression of Large Language Models (LLMs) has witnessed great success in the fields of data-centric applications. LLMs trained on massive textual datasets showed ability to encode not only context but also ability to provide powerful comprehension to downstream tasks. Interestingly, Generative Pre-trained Transformers utilised this ability to bring AI a step closer to human being replacement in at least datacentric applications. Such power can be leveraged to identify anomalies of cyber threats, enhance incident response, and automate routine security operations. We provide an overview for the recent activities of LLMs in cyber defence sections, as well as categorization for the cyber defence sections such as threat intelligence, vulnerability assessment, network security, privacy preserving, awareness and training, automation, and ethical guidelines. Fundamental concepts of the progression of LLMs from Transformers, Pre-trained Transformers, and GPT is presented. Next, the recent works of each section is surveyed with the related strengths and weaknesses. A special section about the challenges and directions of LLMs in cyber security is provided. Finally, possible future research directions for benefiting from LLMs in cyber security is discussed.