The Impact of Large Language Models (LLMs) on Cybersecurity
Three years after ChatGPT's public launch, large language models have moved well past chatbots and customer service scripts. In security operations centers, LLMs and their more autonomous cousins, AI agents, are now doing real work: triaging alerts, writing detection rules, investigating incidents across multiple systems at once. But the same technology defenders are adopting, attackers are adopting faster, and the gap between the two is where most of the interesting risk sits right now.
The generative AI market itself is projected to reach $29.6 billion in 2026, up from $22.2 billion in 2025, growing at a 40.8% compound annual rate through 2033, according to Grand View Research. Security is one of the fastest-adopting segments within that growth, and 2026 has become the year the "agentic SOC" stopped being a slide-deck concept and started shipping in production.
Also Read: Machine Learning and Artificial Intelligence in Cybersecurity
From LLM to agent: what changed
The original wave of LLM cybersecurity applications, summarizing threat intel, drafting incident reports, answering natural-language queries against log data, was useful but largely passive. The model produced text, and a human decided what to do with it.
What's shifted in 2026 is autonomy. Security vendors are now shipping agents that don't just suggest actions, they take them, within defined guardrails. CrowdStrike calls its approach "bounded autonomy," meaning teams define exactly when and how automated actions occur rather than granting an agent an open mandate, according to reporting on the company's Charlotte Agentic SOAR platform. That distinction matters more than it sounds. An agent that can only act within a defined blast radius is a very different risk profile than one that can improvise.
Microsoft published a randomized controlled trial showing its phishing triage agent helped analysts identify up to 6.5 times as many true positives per analyst minute, with a 77% improvement in verdict F1 score against a control group, per VentureBeat's coverage of the study. Interestingly, the study attributed 83% of that productivity gain to the agent reordering the analyst's queue and auto-resolving reports it judged benign, rather than to the quality of its individual verdicts. That's a useful reminder that a lot of AI's value in security operations right now comes from workflow triage, not from some superhuman detection capability.
How organizations are actually using this today
1. Threat detection and cross-domain investigation
This remains the highest-value application. Rather than a human analyst manually pivoting between endpoint logs, identity data, and cloud telemetry, coordinated teams of specialist agents can investigate across all of it in parallel and converge on a single verdict, escalating to a human only when needed. CrowdStrike's 2026 Global Threat Report found that average adversary breakout time, the time from initial access to lateral movement, has dropped to 29 minutes, with the fastest recorded breakout at just 27 seconds. Defenders investigating manually simply cannot move at that speed; automated correlation across domains is becoming table stakes rather than a luxury.
2. Security posture and compliance analysis
LLMs trained on configuration baselines can scan log files, infrastructure-as-code templates, and policy documentation to flag misconfigurations or gaps against frameworks like NIST or SOC 2. This isn't glamorous work, but it's exactly the kind of repetitive, detail-heavy analysis that used to eat junior analyst time.
Also Read: Differences Between SOC 2 and SOC 1 Reports
3. Vulnerability discovery and patching
Google's security-tuned Gemini variant, released in September 2026 for vulnerability discovery and automated patching, scored 86.2% on the CyberGym benchmark and produced 2.6 times more correct patches to Chrome vulnerabilities than larger general-purpose models, according to Google's own reporting cited by VentureBeat. Access is currently limited through Google's Fairwind Program to trusted government and critical infrastructure operators, which tells you something about how sensitive this capability still is considered.
4. Code review and debugging
Tools like GitHub Copilot remain the clearest mainstream example of LLMs applied to finding syntax errors, logic flaws, and vulnerable patterns in code. This use case has matured to the point that it's now a baseline expectation in most development pipelines rather than a novelty.
The honeypot moment: when AI started attacking too
Here's the part of this story that should genuinely concern security leaders, not just interest them. At Fal.Con 2026, Amazon's CISO CJ Moses described something Amazon's MadPot honeypot network had captured: an AI agent completing a full cyberattack autonomously. "One of the honeypots actually captured an AI agent that was completing a full cyber attack, and it did it in 12 minutes and 42 seconds," Moses said, sharing the stage with CrowdStrike President Michael Sentonas. "It was 94 events, zero syntax errors, the ability for it to respond in less than 500 milliseconds."
Sentonas connected this to a broader shift he's seeing across the industry: "I will argue that the breakout time is over. We now live in a world where a model finds a vulnerability and weaponizes it at the same time." CrowdStrike's own data backs this up: the company reported an 89% year-over-year increase in attacks by adversaries it classifies as AI-enabled in its 2026 Global Threat Report.
This is the double-edged sword that makes LLM security genuinely different from most previous security technology cycles. The same reasoning capability that helps a defensive agent correlate weak signals across systems also helps an offensive agent chain together an exploit without a human writing each step by hand.
Real risks organizations need to plan for
Prompt injection attacks
This is arguably the most LLM-specific risk category, and it's evolved considerably since 2023. Indirect prompt injection, where malicious instructions are hidden in content an AI agent processes rather than typed directly by an attacker, has become the dominant attack pattern. Palo Alto Networks' Unit 42 published research in March 2026 cataloguing 22 distinct techniques attackers use to craft web-based injection payloads, with plain visible text the most common delivery method at 37.8%, ahead of HTML attribute cloaking and CSS-based concealment, according to independent research summarizing the Unit 42 findings. In practice this looks like a coding agent reading a webpage or a document that contains hidden instructions telling it to exfiltrate data or run unintended commands, and the agent, having no inherent way to distinguish "instructions from my user" from "instructions embedded in content I'm reading," just complies.
Please see this complete guide to chatbot prompt injection attacks for a deeper technical breakdown.
AI-generated phishing and social engineering
LLMs can generate highly personalized phishing content by drawing on scraped social media data and public information about a target. Combined with deepfake voice tools, this has produced measurable financial damage: deepfake audio paired with business email compromise is implicated in $420 million in fraud losses in 2025 alone, according to fraud prevention firm Sumsub, where synthetic voice calls were used to confirm fraudulent wire transfer requests that originated by email.
Also Read: Email Attacks and How to Protect Your Organization Against Them
Malicious code generation
Attackers can prompt or jailbreak LLMs into generating malware components or exploit code, then assemble the pieces into a working attack. This is closely connected to the IT infrastructure components risk conversation, since generated code targeting infrastructure automation or configuration management tools can have outsized blast radius if it executes with elevated permissions.
Training data poisoning
Corrupting the data an LLM learns from remains a longer-horizon but serious risk, particularly for organizations fine-tuning models on internal data. An attacker doesn't necessarily need direct access to the training pipeline; backdoor techniques exist that can inject a trojan module triggered later by a specific input token, without ever touching the original dataset.
Hallucination in security-critical contexts
This one doesn't get enough attention. When an LLM confidently presents a factually wrong remediation step or a false-positive threat assessment, an under-resourced team can end up chasing a phantom incident, or worse, skipping a real one because the model dismissed it. This is exactly why CrowdStrike, Microsoft, and others emphasize keeping a human in the loop for consequential actions rather than granting full autonomy.
Mitigations worth taking seriously
- Adversarial training: exposing models to known attack patterns, malicious prompts, and phishing examples during training so they learn to recognize and flag similar inputs rather than comply with them.
- Bounded autonomy and human-in-the-loop gating: defining explicitly which actions an agent can take unsupervised versus which require human approval, rather than granting blanket permissions.
- Federated learning: training on distributed local data rather than centralizing everything in one exploitable repository, reducing the blast radius of any single compromise.
- Gradient masking and output regularization: technical defenses against adversarial input crafting techniques like the Fast Gradient Sign Method, which attackers use to nudge a model toward misclassification.
- Encryption and anonymization of training data: reducing the value of a stolen dataset and limiting exposure of personal information if a breach does occur.
Also Read:
An honest assessment: vendor claims versus buyer reality
Something worth flagging directly, because it doesn't get said often enough in vendor marketing: there is currently no common unit of measurement across security AI vendors. CrowdStrike, Google, Palo Alto, and Microsoft each publish different metrics measuring different things, a detection uplift inside one platform isn't comparable to a patching benchmark score, which isn't comparable to an analyst productivity trial. According to VentureBeat's Pulse Research survey of 116 enterprises building or piloting agents, 85 out of 93 respondents named a security control that shipped with their existing model provider or cloud platform as their primary defense layer, not a specialized security AI vendor. Across the full sample, CrowdStrike appeared in just 7% of security stacks and Palo Alto Networks in 6%. The lesson: most organizations are defaulting to whatever ships with the tools they already have, not shopping for the most sophisticated purpose-built model.
Kayne McGladrey, an independent virtual CISO not affiliated with any major AI security vendor, offered a useful reality check to VentureBeat: "The barrier to entry is normalized, labeled data and funding allocation, not some magical capability gap." His broader point, and it's a fair one, is that most organizations losing to AI-driven attacks "were losing to basic cybersecurity hygiene failures long before the swarms of agents arrived." Buying the newest AI security tool doesn't fix an unpatched server or a shared admin password.
Conclusion
LLMs and AI agents have genuinely changed what's operationally possible in a security team, faster cross-domain investigation, automated triage that clears analyst queues, patching workflows that used to take days now taking hours. But the honest picture in 2026 isn't a clean story of AI saving security teams. It's an arms race where the same underlying capability accelerates both sides, and where the vendor with the flashiest benchmark isn't necessarily the vendor solving your actual problem.
Before adding another AI layer to your security stack, map what any new agent can access, what permissions it holds, and what happens if its verdicts are wrong. As Andrew Obadiaru, CISO at Cobalt, put it in an interview with VentureBeat: "Before even increasing an agent's autonomy, it is important to map its identity, permissions, tools, and data, and what the downstream actions they have access to. If you don't know what you have, you can't protect against it." That's not a flashy conclusion, but it's the one that actually holds up.
