# Summary: 2026-08-01_13-47-44Z_FromChasingGhoststoMissedAttacks_PerspectivesandPe.md
Saved: 2026-08-03 20:29
Source: 2026-08-01_13-47-44Z_FromChasingGhoststoMissedAttacks_PerspectivesandPe.md
Model: None

---

## Summary  
The paper investigates how security operations center (SOC) practitioners view the integration of large language models (LLMs) into their workflows, focusing on perceived benefits, risks, and organizational readiness. Through 25 semi‑structured interviews combined with interactive scenario exercises, the authors map 15 LLM use cases across six functional categories and uncover a nuanced picture where low‑level automation is welcomed while high‑impact tasks remain out of reach. The study argues that technical limitations are secondary to SOC maturity and human factors such as over‑reliance on AI. It delivers concrete design requirements for a safe, human‑centered LLM‑assisted security operation.

## Key Contributions  
- **Finding 1:** LLMs are currently valued for automating repetitive, low‑level tasks (e.g., report generation) but are not yet capable of handling high‑impact activities like incident analysis.  
- **Finding 2:** The primary barriers to LLM adoption stem from SOC readiness—lack of technical depth, context awareness, and organization‑specific knowledge—as well as human factors that encourage over‑reliance on the models.  
- **Finding 3:** Despite these constraints, practitioners express strong motivation to adopt LLMs because competitive pressure leaves few alternatives.

## Methodology  
The authors employed a mixed‑methods approach: they conducted 25 semi‑structured interviews with SOC professionals who had prior experience using LLMs and supplemented the qualitative data with interactive scenario simulations designed to elicit challenges and opportunities for responsible integration. This combination allowed them to capture both reflective insights and real‑time decision making.

## Results  
The interview corpus identified fifteen distinct LLM use cases grouped into six functional categories (automation, triage, reporting, threat hunting, policy enforcement, and knowledge management). While low‑level automation received high approval, incident analysis and other critical tasks were rated as infeasible. Practitioners highlighted three core limitations: insufficient technical depth, poor contextual understanding, and a lack of organization‑specific knowledge. The study also revealed that these gaps are more about the SOC’s readiness than the models themselves, with human over‑reliance posing an additional risk.

## Significance  
This work provides an empirical, practitioner‑driven analysis of LLM deployment in security operations, moving beyond theoretical optimism to actionable design and integration requirements. By clarifying where LLMs fit within existing workflows and what safeguards are needed, the study helps organizations plan a human‑centered, operationally safe transition toward AI‑assisted SOC capabilities.

## Related Concepts  
Large Language Models (LLMs), Security Operations Center (SOC), incident analysis, automation, readiness, human factors, over‑reliance on AI, operational safety.