大模型网摘AI in security operations: alert triage, vulnerability screening and red-team support
The restricted rollout of GPT-6 Cyber puts "models doing security" back on center stage (see our release report). For most enterprises, the real question is not whether to use frontier security models, but how much of the daily work in three scenarios — alert triage, vulnerability screening and red-team support — a model can absorb, and where humans must remain.
Scenario 1: alert triage and noise reduction
A security operations center faces thousands of alerts a day. Models fit the merging and screening step: grouping alerts that share a root cause, ranking them by asset importance, drafting an incident summary for each, and letting people handle only escalations. Three implementation points: write the classification criteria down and feed them to the model instead of letting it guess; fix an audit sampling rate and put it in the process; let the model recommend dispositions but never execute blocks automatically.
Scenario 2: vulnerability screening
Raw scanner output is noisy, and models are good at translating CVE descriptions into prioritized suggestions within asset context, drafting reproduction steps and fix tickets. The disclosed GPT-6 Cyber numbers — 81 previously unknown Firefox flaws and 948 Linux privilege-escalation exploits — show a ceiling that is considerable even for professional teams. Those are jointly disclosed results from the vendor and security teams, though; for ordinary teams the realistic starting point is result interpretation, not vulnerability discovery.
Scenario 3: red-team support and reporting
For authorized penetration testing, models help with test-case generation, variant writing and report drafts. Boundaries must become hard constraints: target scope lists, prohibition lists and time windows all go into prompts and tool whitelists. The Daybreak Red idea of scope limitation is worth borrowing — turning authorization from a contract clause into a system-level constraint.
The data-never-leaves route
Security data is sensitive, and many teams cannot use public APIs. Open-weight self-hosting is the ready answer: from DeepInfer-based inference to single-machine projects like Promethevs, at the cost of lower capability and throughput than flagship APIs. For code-adjacent automation, also see our three patterns for LLM code review in CI.
Where humans stay
The lesson of the GPT-6 Astra alignment report: a model's self-assessment cannot be taken at face value, least of all in security. Every model-produced security conclusion needs a review process, and critical operations keep a human gate. Models take the repetitive labor; judgment and authorization stay with people.