From Chasing Ghosts to Missed Attacks: SOC Practitioners on LLM Integration, Risks, and Readiness

This study uses 25 semi-structured interviews with SOC practitioners experienced with LLMs, supplemented by interactive scenarios, to examine operational adoption. It identifies 15 use cases across six functional categories. Participants value LLMs for repetitive, lower-level work such as report automation, but consider high-impact tasks such as incident analysis not yet feasible because of limited technical depth, context awareness, and organization-specific knowledge. They also emphasize organizational readiness and human over-reliance, while reporting strong adoption pressure.