Employing LLMs for Incident Response Planning and Review

Incident Response Planning (IRP) is essential for effective cybersecurity management, requiring detailed documentation (or playbooks) to guide security personnel during incidents. Yet, creating comprehensive IRPs is often hindered by challenges such as complex systems, high turnover rates, and legacy technologies lacking documentation. This paper argues that, despite these obstacles, the development, review, and refinement of IRPs can be significantly enhanced through the utilization of Large Language Models (LLMs) like ChatGPT. By leveraging LLMs for tasks such as drafting initial plans, suggesting best practices, and identifying documentation gaps, organizations can overcome resource constraints and improve their readiness for cybersecurity incidents. We discuss the potential of LLMs to streamline IRP processes, while also considering the limitations and the need for human oversight in ensuring the accuracy and relevance of generated content. Our findings contribute to the cybersecurity field by demonstrating a novel approach to enhancing IRP with AI technologies, offering practical insights for organizations seeking to bolster their incident response capabilities.

Paper

References (5)

02Nist special publication 800-61 rev. 22012 · computer security incident handling guide
03There’s a s.m.a.r.t. way to write management’s goals and objectives1981 · Management Review
04Detection and Analysis: Focus on identifying and investigating suspected incidents through the analysis of precursors and indicators, gathering information
05Visitor Management : A basic visitor management policy, including sign-in and possibly accompanied visits for unknown visitors

Similar papers

© 2026 NYSGPT2525 LLC