What is a documented risk associated with using large language models in security operations?

• A. Increases hardware requirements
• B. AI-phishing exploitation
• C. Eliminates need for analysts
• D. Improved incident response speed

Answer: (B)

Using large language models in security operations introduces a real, documented risk through AI-powered phishing. These models can generate highly realistic, tailored messages at scale, making spear-phishing campaigns far more convincing and efficient. Attackers can craft subject lines, body text, and even replies that imitate coworkers, brands, or trusted institutions, often incorporating specific details gathered about targets. This level of personalization can boost engagement rates, evade simple filters, and enable broad, rapid campaigns that previously required more manual effort. Because phishing remains a leading attack vector, the ability of LLMs to automate and refine social engineering at scale is a recognized security concern.

Other options describe either constraints or benefits rather than risks. Increased hardware requirements are about resource needs rather than a direct operational risk, and eliminating the need for analysts would actually be an unrealistic, negative outcome—LLMs are more likely to augment rather than replace human analysts. Improved incident response speed is a potential benefit, not a risk.