# Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit

arXiv: https://arxiv.org/abs/2604.09998 · HTML: https://mlsanity.com/paper/2604.09998/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 105 references that are in the map.
- First posted on arXiv 11 Apr 2026.

## Builds on (most cited first, 24 of 24)

- [A Survey on Large Language Models for Code Generation](https://mlsanity.com/paper/2406.00515/) (2024)
- [Prompt Injection attack against LLM-integrated Applications](https://mlsanity.com/paper/2306.05499/) (2023)
- [LLM Lies: Hallucinations are not Bugs, but Features as Adversarial Examples](https://mlsanity.com/paper/2310.01469/) (2023)
- [The Good, The Bad, and The Greedy: Evaluation of LLMs Should Not Ignore Non-Determinism](https://mlsanity.com/paper/2407.10457/) (2024)
- [JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs](https://mlsanity.com/paper/2402.05668/) (2024)
- [Non-Determinism of "Deterministic" LLM Settings](https://mlsanity.com/paper/2408.04667/) (2024)
- [SAGA: A Security Architecture for Governing AI Agentic Systems](https://mlsanity.com/paper/2504.21034/) (2025)
- [Large Language Models are Edge-Case Fuzzers: Testing Deep Learning Libraries via FuzzGPT](https://mlsanity.com/paper/2304.02014/) (2023)
- [Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns](https://mlsanity.com/paper/2405.06371/) (2024)
- [LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres](https://mlsanity.com/paper/2508.18947/) (2025)
- [CORTEX: Collaborative LLM Agents for High-Stakes Alert Triage](https://mlsanity.com/paper/2510.00311/) (2025)
- [IRCopilot: Automated Incident Response with Large Language Models](https://mlsanity.com/paper/2505.20945/) (2025)
- [CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning](https://mlsanity.com/paper/2509.20166/) (2025)
- [From Promise to Peril: Rethinking Cybersecurity Red and Blue Teaming in the Age of LLMs](https://mlsanity.com/paper/2506.13434/) (2025)
- [Locus: Agentic Predicate Synthesis for Directed Fuzzing](https://mlsanity.com/paper/2508.21302/) (2025)
- [A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy](https://mlsanity.com/paper/2505.23397/) (2025)
- [An Assessment of the Usability of Machine Learning Based Tools for the Security Operations Center](https://mlsanity.com/paper/2012.09013/) (2020)
- [NL2KQL: From Natural Language to Kusto Query](https://mlsanity.com/paper/2404.02933/) (2024)
- [Towards AI-Driven Human-Machine Co-Teaming for Adaptive and Agile Cyber Security Operation Centers](https://mlsanity.com/paper/2505.06394/) (2025)
- [Human-AI Co-Learning for Data-Driven AI](https://mlsanity.com/paper/1910.12544/) (2019)
- [CyberMentor: AI Powered Learning Tool Platform to Address Diverse Student Needs in Cybersecurity Education](https://mlsanity.com/paper/2501.09709/) (2025)
- [Too Much to Trust? Measuring the Security and Cognitive Impacts of Explainability in AI-Driven SOCs](https://mlsanity.com/paper/2503.02065/) (2025)
- [Effective and Efficient Threat Hunting with Small Language Models](https://mlsanity.com/paper/2512.06660/) (2025)
- [Before the Vicious Cycle Starts: Preventing Burnout Across SOC Roles Through Flow-Aligned Design](https://mlsanity.com/paper/2602.14598/) (2026)

## Built on by (most cited first, 1 of 1)

- [It is Not Yet Another Tool: Creating and Deploying an Agentic AI Companion in a Security Operations Center](https://mlsanity.com/paper/2609.06250/) (2026)

## Abstract (arXiv)

Large language models (LLMs) have recently emerged as promising tools for augmenting Security Operations Center (SOC) workflows, with vendors increasingly marketing autonomous AI solutions for SOCs. However, there remains a limited empirical understanding of how such tools are used, perceived, and adopted by real-world security practitioners. To address this gap, we conduct a mixed-methods analysis of discussions in cybersecurity-focused forums to learn how a diverse group of practitioners use and perceive modern LLM tools for security operations. More specifically, we analyzed 892 posts between December 2022 and September 2025 from three cybersecurity-focused forums on Reddit, and, using a combination of qualitative coding and statistical analysis, examined how security practitioners discuss LLM tools across three dimensions: (1) their stated tools and use cases, (2) the perceived pros and cons of each tool across a set of critical factors, and (3) their adoption of such tools and the expected impacts on the cybersecurity industry and individual analysts. Overall, our findings reveal nuanced patterns in LLM tools adoption, highlighting independent use of LLMs for low-risk, productivity-oriented tasks, alongside active interest around enterprise-grade, security-focused LLM platforms. Although practitioners report meaningful gains in efficiency and effectiveness in LLM-assisted workflows, persistent issues with reliability, verification overheads, and security risks sharply constrain the autonomy granted to LLM tools. Based on these results, we also provide recommendations for developing and adopting LLM tools to ensure the security of organizations and the safety of cybersecurity practitioners.