City Research Online

Abstract

The rapid adoption of large language models (LLMs) in cybersecurity has generated a growing and diverse body of research spanning threat detection, vulnerability analysis, malware investigation, incident response, and security automation. Despite this growth, existing reviews largely organise the literature by application domain and few relate research activity to operational threat models. This study addresses this gap through a systematic mapping study of 246 peer-reviewed publications published between 2023 and 2026. Following PRISMA guidelines, the literature is analysed through the MITRE ATT&CK framework, providing a structured mapping of LLM-based cybersecurity research to adversarial tactics, techniques, and mitigations. The findings indicate an uneven distribution of research effort across the cybersecurity lifecycle, with substantial concentration in selected ATT&CK areas and limited coverage of several operationally important tactics. The analysis also highlights recurring challenges related to data availability, robustness, scalability, generalisation, and reproducibility. Beyond synthesising current research activity, the study provides an ATT&CK-grounded perspective on the field that supports the identification of research gaps, facilitates comparison across application domains, and establishes a foundation for future investigations of LLM enabled cybersecurity systems.

Publication Type:	Article
Additional Information:	© Author. This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
Publisher Keywords:	Large Language Models, Cybersecurity, MITRE ATT&CK, Attack Tactics, Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA)
Subjects:	H Social Sciences > HD Industries. Land use. Labor > HD61 Risk Management Q Science > QA Mathematics > QA75 Electronic computers. Computer science Q Science > QA Mathematics > QA76 Computer software
Departments:	School of Science & Technology School of Science & Technology > Department of Computer Science
SWORD Depositor:	Symplectic Administrator

Export

Downloads