SOCpilot: Verifying Policy Compliance for LLM-Assisted Incident Response

Sidnei Barbieri, Leonardo Vaz de Meneses, Ágney Lopes Roth Ferraz +1

Security operations centers (SOCs) are beginning to use large language models (LLMs) as copilots to draft incident-response plans. These plans may include actions that are valid pe…