Generative AI for next generation cyber security from threat intelligence to autonomous defence

We examined how generative AI can support a defender from the first piece of intelligence to the final containment action, and proposed GenDefend as a five-layer design that keeps humans in control of high-risk decisions. Our experiments on a synthetic dataset indicate that threat-intelligence features add measurable value, that generative augmentation gives a modest gain for rare attacks without clearly beating simpler oversampling, and that reconstruction-based scoring is a useful but not universally best detector of unseen attacks. A simulation under stated assumptions suggests that graded autonomy can shorten containment considerably while exposing a clear trade-off with unnecessary disruption. Because the evidence is synthetic, the main value of this work is the structure it offers and the questions it sharpens; confirming the findings on real data is the next step

[1]      S. Metta, I. Chang, J. Parker, M. P. Roman, and A. F. Ehuan, “Generative AI in cybersecurity,” 2024, arXiv:2405.01674. [2]      P. Balasubramanian, S. Liyana, H. Sankaran, S. Sivaramakrishnan, S. Pusuluri, S. Pirttikangas, and E. Peltonen, “Generative AI for cyber threat intelligence: Applications, challenges, and analysis of real-world case studies,” Artif. Intell. Rev., vol. 58, Art. no. 336, 2025, doi: 10.1007/s10462-025-11338-z. [3]      M. A. Ferrag, F. Alwahedi, A. Battah, B. Cherif, A. Mechri, and N. Tihanyi, “Generative AI and large language models for cyber security: All insights you need,” 2024, arXiv:2405.12750. [4]      Y. Yao, J. Duan, K. Xu, Y. Cai, Z. Sun, and Y. Zhang, “A survey on large language model (LLM) security and privacy: The good, the bad, and the ugly,” High-Confidence Comput., vol. 4, no. 2, 2024. [5]      H. Xu et al., “Large language models for cyber security: A systematic literature review,” 2024, arXiv:2405.04760. [6]      M. Andreoni, W. T. Lunardi, G. Lawton, and S. Thakkar, “Enhancing autonomous system security and resilience with generative AI: A comprehensive survey,” IEEE Access, vol. 12, pp. 109470–109493, 2024, doi: 10.1109/ACCESS.2024.3439363. [7]      M. Bayer, P. Kuehn, R. Shanehsaz, and C. Reuter, “CySecBERT: A domain-adapted language model for the cybersecurity domain,” ACM Trans. Privacy Secur., vol. 27, no. 2, pp. 1–20, May 2024. [8]      M. A. Ferrag et al., “Revolutionizing cyber threat detection with large language models: A privacy-preserving BERT-based lightweight model for IoT/IIoT devices,” IEEE Access, vol. 12, pp. 23733–23750, 2024. [9]      S. Shafee, A. Bessani, and P. M. Ferreira, “Evaluation of LLM chatbots for OSINT-based cyber threat awareness,” 2024, arXiv:2401.15127. [10]    F. Sufi, “An innovative GPT-based open-source intelligence using historical cyber incident reports,” Natural Lang. Process. J., vol. 7, Art. no. 100074, Jun. 2024.