Harnessing the power of language models in cybersecurity: A comprehensive review
Ramanpreet Kaur, Tomaž Klobučar, Dušan Gabrijelčič
Abstract
• State-of-the-art analysis of language models in cybersecurity field. • Outline of the development of customized large language models (LLMs) for cybersecurity. • In-depth analysis of challenges and solutions in implementing and operating customized LLMs for cybersecurity. Language models are transforming cybersecurity by addressing critical challenges such as the growing skills gap, the need for expertise augmentation, and knowledge retention. These models offer scalable, adaptable, and round-the-clock defenses against evolving cyber threats. By generating human-like text, processing data efficiently, and providing actionable responses, language models bridge the gap between automated systems and human expertise for different cybersecurity applications. However, the application and adaptation of language models for cyber security is still in its infancy. This review explores the use of general models, such as BERT, and larger models in cybersecurity research. It provides a structured framework for developing customized language models tailored to applications including content analysis, software and systems analysis, threat intelligence and monitoring, and cyber vetting. The study critically examines challenges, such as data confidentiality, infrastructure requirements, integration complexity and the evolving threat landscape. Moreover, it underscores the need for transparency, responsible use, and bias mitigation to ensure reliable and secure deployment of these models. In addition, this work critically examines the socio-technical dimensions of language model integration, focusing on their impact on organizational workflows, decision making and human-machine collaboration. By considering both technical and socio-technical considerations, this review provides a roadmap for future research and development. It highlights the potential of language models to improve organizational resilience, ensure secure implementation, and support informed decision-making in cybersecurity practice.