On-Premise SLMs vs. Commercial LLMs: Prompt Engineering and Incident Classification in SOCs and CSIRTs
Not on the map. Why?
Abstract (arXiv)
In this study, we evaluate open-source models for security incident classification, comparing them with proprietary models. We utilize a dataset of anonymized real incidents, categorized according to the NIST SP 800-61r3 taxonomy and processed using five prompt-engineering techniques (PHP, SHP, HTP, PRP, and ZSL). The results indicate that, although proprietary models still exhibit higher accuracy, locally deployed open-source models provide advantages in privacy, cost-effectiveness, and data sovereignty.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 5 of its 12 references that are in the map. First posted on arXiv 18 Nov 2025.
Builds on
5 of 12 references.
References · 5
- 2025Llama-3.1-FoundationAI-SecurityLLM-Base-8B Technical Reportcited by 28
- 2023Scaling Down to Scale Up: A Cost-Benefit Analysis of Replacing OpenAI's LLM with Open Source SLMs in Productioncited by 21
- 2025A Cost-Benefit Analysis of On-Premise Large Language Model Deployment: Breaking Even with Commercial LLM Servicescited by 15
- 2025Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligencecited by 6
- 2025Less Data, More Security: Advancing Cybersecurity LLMs Specialization via Resource-Efficient Domain-Adaptive Continuous Pre-training with Minimal Tokenscited by 4
Built on by
Not cited yet.