LLM

What is an LLM?

An LLM, or Large Language Model, is an AI model trained on enormous volumes of text data to understand language, generate human readable output, and perform tasks like summarisation, classification, code generation, and question answering.

The "large" in the name refers to scale on 2 axes: the amount of training data (often hundreds of billions of words) and the number of parameters in the model (the internal numerical weights that encode what it has learned). GPT-4, Claude, Gemini, and Llama are all LLMs. So are the models increasingly embedded inside enterprise software, security tools, and internal productivity apps.

For security teams, the relevant fact isn't how LLMs are built; it's where they're showing up. LLMs are now processing internal documents, handling customer queries, summarising incident reports, and writing code inside your organisation's systems. That makes them a data security surface, not just an IT curiosity.

How LLMs work

Training on text at scale. LLMs are trained by exposing them to massive text corpora: books, websites, code repositories, academic papers. During training, the model learns statistical patterns in language, essentially learning which words and concepts follow others across billions of examples. The output is a model with billions of parameters that encode a compressed representation of the patterns in that data.

The transformer architecture. Most modern LLMs use a transformer architecture, which processes language by computing relationships between all words in a sequence simultaneously (rather than one word at a time). This is what gives LLMs their ability to handle context: a 128,000-token context window means the model can reason across roughly 100,000 words at once.

Fine-tuning and deployment. A base LLM is typically fine-tuned on more specific data (e.g., instruction-following examples, domain-specific corpora) before deployment. Enterprise LLM deployments often involve connecting the model to internal data sources via retrieval-augmented generation (RAG), where the model retrieves relevant documents at query time rather than relying solely on its training data.

The prompt as the interface. Users interact with an LLM through a prompt: a natural language instruction or query. The model generates a response token by token, predicting the most likely continuation given its training and the prompt context. This means the quality and sensitivity of the input determines, in part, what the model produces. From a security perspective: whatever goes into a prompt is processed by the model, potentially logged, and in some architectures, stored.

Where LLMs add the most value

LLMs show up in security workflows in 3 concrete ways.

Accelerating security operations. Analysts are spending hours reading through logs, writing incident summaries, and translating threat intelligence reports. An LLM embedded in a SIEM or SOAR platform can summarise 500 lines of alert context in seconds, draft an incident report, or answer a natural-language query against historical telemetry. The business outcome: faster triage, shorter MTTR, and analysts spending time on judgement calls rather than documentation.

Improving developer security tooling. Security teams are increasingly expected to review code and infrastructure-as-code for vulnerabilities. LLMs can scan code, explain what a suspicious snippet does, suggest fixes for known vulnerability patterns, and generate secure-by-default boilerplate. The business outcome: security reviews that don't block engineering velocity, and developers who can self-serve answers to security questions without waiting for a dedicated review.

Powering internal knowledge and policy tooling. Compliance teams and legal are fielding the same questions repeatedly: what does our data retention policy say? Which data can be shared with this vendor? An LLM trained or fine-tuned on internal policy documents can answer those questions accurately at scale. The business outcome: fewer compliance bottlenecks and a consistent interpretation of policy across the organisation.

LLM use cases

Threat intelligence summarisation. A SecOps team receives a steady stream of threat intelligence feeds: CVE disclosures, vendor advisories, industry threat reports. An LLM integrated into their workflow summarises each into a 3-sentence brief, tags it by relevance to their specific stack, and drafts a recommendation. Analysts review rather than read, and fewer high-severity advisories fall through the cracks.

Security chatbot for developer self-service. A security team builds an internal chatbot on top of an LLM fine-tuned on their security standards, approved libraries, and vulnerability remediation guides. Developers ask questions like "is this S3 configuration compliant with our encryption policy?" and get accurate, policy specific answers without filing a ticket. The security team's review queue shrinks significantly.

Incident response drafting. After containment, incident responders use an LLM to draft the post incident report. The model ingests the alert timeline, the affected systems, and the containment actions taken, and generates a structured narrative. The responder edits rather than writes from scratch, cutting report writing time by 60-80%.

Data classification at scale. A data security team needs to classify 2 million documents across a cloud data lake. Traditional keyword based classifiers miss context; they flag "patient" in a recipe blog and miss PII in a free text field. An LLM based classifier understands context and can identify sensitive data (PII, financial records, credentials) with far higher accuracy across unstructured text. Classification projects that took months compress to days.

Code review for security vulnerabilities. A security engineer uses an LLM to assist with code review on a large pull request. The model flags potential injection vulnerabilities, highlights use of deprecated cryptographic functions, and explains why each is a risk. The engineer still makes the call, but the review goes from half a day to an hour.

LLM vs. traditional ML models

LLMs are often lumped together with machine learning broadly, but they're a specific and quite different category from the ML models that have historically underpinned security tools.

For security teams, this distinction matters practically. A traditional ML model trained to detect anomalous login behaviour will outperform an LLM on that specific task. An LLM will outperform a traditional model on anything that requires understanding context in free text: summarising incidents, interpreting unstructured logs, answering questions about policy. The best security stacks use both.