What researchers learned about building an LLM security workflow

The article reviews a research paper from the University of Oslo and the Norwegian Defence Research Establishment that tested several LLMs on SOC alert triage: models given only high-level summaries failed to flag malicious activity, but wrapping the same models in a constrained, multi-agent workflow that could run predefined queries increased detection accuracy to about 93%. The authors note caveats including conservatism on benign cases and the need for broader testing against real intrusion data.