Integrating Large Language Models into Security Incident Response

Explore a research presentation examining the integration of large language models into cybersecurity incident response workflows. Learn about a comprehensive study conducted by researchers from Google and DataPhant that investigates whether LLMs can automate or assist with the critical final step of incident response investigations: summarizing findings for stakeholders, auditors, and legal experts. Discover findings from experiments involving 18 security analysts and 50 real-world incidents that evaluate LLM capabilities in three key areas: autonomous security event reasoning and summary generation, collaborative assistance with security analysts in summarization tasks, and the overall benefits and risks of LLM integration into incident summarization processes. Understand the study's key findings that current LLMs may lack sufficient security reasoning for autonomous operation, with summaries omitting critical details in 35% of cases and injecting factual inaccuracies in 42% of cases. Examine how collaborative LLM usage can reduce analyst effort while improving summary readability and consistency. Gain insights into opportunities for enhancing LLM security reasoning capabilities and explore potential applications for incident response beyond summarization.