mlsanityData to 14 Oct 2026

CyLens: Towards Reinventing Cyber Threat Intelligence in the Paradigm of Agentic Large Language Models

arXiv 2502.20791 ↗First posted 28 Feb 2025cs.CRcited by 6

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

The exponential growth of cyber threat knowledge, exemplified by the expansion of databases such as MITRE-CVE and NVD, poses significant challenges for cyber threat analysis. Security professionals are increasingly burdened by the sheer volume and complexity of information, creating an urgent need for effective tools to navigate, synthesize, and act on large-scale data to counter evolving threats proactively. However, conventional threat intelligence tools often fail to scale with the dynamic nature of this data and lack the adaptability to support diverse threat intelligence tasks. In this work, we introduce CYLENS, a cyber threat intelligence copilot powered by large language models (LLMs). CYLENS is designed to assist security professionals throughout the entire threat management lifecycle, supporting threat attribution, contextualization, detection, correlation, prioritization, and remediation. To ensure domain expertise, CYLENS integrates knowledge from 271,570 threat reports into its model parameters and incorporates six specialized NLP modules to enhance reasoning capabilities. Furthermore, CYLENS can be customized to meet the unique needs of different or ganizations, underscoring its adaptability. Through extensive evaluations, we demonstrate that CYLENS consistently outperforms industry-leading LLMs and state-of-the-art cybersecurity agents. By detailing its design, development, and evaluation, this work provides a blueprint for leveraging LLMs to address complex, data-intensive cybersecurity challenges.

Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 18 of its 95 references that are in the map. First posted on arXiv 28 Feb 2025.

Builds on

18 of 95 references.

References · 18

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  3. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  4. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  5. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
  6. 2023Tool Learning with Foundation Modelscited by 302
  7. 2024Embodied Agent Interface: Benchmarking LLMs for Embodied Decision Makingcited by 144
  8. 2017Continuous Adaptation via Meta-Learning in Nonstationary and Competitive Environmentscited by 108
  9. 2023Lemur: Harmonizing Natural Language and Code for Language Agentscited by 72
  10. 2023Hot or Cold? Adaptive Temperature Sampling for Code Generation with Large Language Modelscited by 38
  11. 2021AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reportscited by 31
  12. 2021On Fast Adversarial Robustness Adaptation in Model-Agnostic Meta-Learningcited by 29
6 more
  1. 2025OCCULT: Evaluating Large Language Models for Offensive Cyber Operation Capabilitiescited by 12
  2. 2024Cross-Domain Few-Shot Learning via Adaptive Transformer Networkscited by 7
  3. 2022Investigating co-occurrences of MITRE ATT&CK Techniquescited by 4
  4. 2022Towards Measuring Vulnerabilities and Exposures in Open-Source Packagescited by 2
  5. 2024Evaluating the Usability of LLMs in Threat Intelligence Enrichmentcited by 2
  6. 2024Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reportscited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 4.

6 papers.

  1. 2025On the Eligibility of LLMs for Counterfactual Reasoning: A Decompositional Studycited by 5
  2. 2025CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligencecited by 4
  3. 2026The Trap of Trajectory: Towards Understanding and Mitigating Spurious Correlations in Agentic Memorycited by 4
  4. 2026Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Taggingcited by 1
  5. 2026An Agentic Framework Using Rules and LLMs for Embedding and Annotating Descriptive Document Layouts: A Plant Science Use Casecited by 0
  6. 2026Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025AthenaBench: A Dynamic Benchmark for Evaluating LLMs in Cyber Threat Intelligence
  2. 2024Crimson: Empowering Strategic Reasoning in Cybersecurity through Large Language Models
  3. 2025AttackSeqBench: Benchmarking the Capabilities of LLMs for Attack Sequences Understanding
  4. 2023LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testing
  5. 2025LLM-Assisted Proactive Threat Intelligence for Automated Reasoning
  6. 2025DefenderBench: A Toolkit for Evaluating Language Agents in Cybersecurity Environments
  7. 2025Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence
  8. 2025Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques