From static tasks to dynamic reasoning: a characterization framework and study of large language models in next-generation cybersecurity automation

Abstract

Large Language Models (LLMs) are increasingly applied in cybersecurity, but most existing industry use cases focus on static, one-shot tasks such as classification, entity extraction, or summarization. While effective in narrow contexts, these applications fail to capture the complexity of real-world cybersecurity workflows, which often unfold over time, involve evolving inputs, and require multi-step reasoning. In this paper, we shift the focus toward dynamic cyber tasks—problems that demand context awareness, tool interaction, and adaptive decision-making. Our main goal is to define, analyze, and investigate the role of LLMs in automating these dynamic tasks. To achieve this, we introduce a characterization framework that profiles dynamic cyber tasks along four complementary dimensions: operational goal, knowledge grounding, collaboration mode, and cognitive complexity. We survey recent LLM-based systems across seven core domains: threat intelligence, data privacy and security, vulnerability detection, malware detection, intrusion detection, incident response and red teaming automation. Our analysis shows that current systems remain limited by privacy and deployment constraints, stale or incomplete threat knowledge, weak validation of feedback-driven actions, and insufficient evidence of operational benefit. We identify the need for privacy-aware deployment, timely retrieval and knowledge maintenance for emerging threats, process-level evaluation tied to measurable security outcomes, and human oversight within controlled and hybrid automation workflows. These findings clarify where LLMs can provide practical value and where conventional or hybrid approaches may remain more suitable.