Retrieval-Augmented Generation for Cybersecurity Analysis: A Focused Narrative Review and Security-Controlled Workflow
Abstract
Retrieval-augmented generation (RAG) enables large language models (LLMs) to consult external evidence when answering questions. This capability is attractive in cybersecurity, where vulnerability records, exploitation status, threat intelligence, and defensive guidance change frequently. This focused narrative review examines how RAG has been applied to cybersecurity knowledge assistance, vulnerability analysis, threat-intelligence investigation, attack attribution, technique mapping, and incident analysis. The reviewed literature indicates that RAG may reduce unsupported claims by moving volatile facts from parametric memory to an inspectable evidence channel, but retrieval alone does not guarantee correctness. Irrelevant or outdated passages, unsupported citations, conflicting reports, indirect prompt injection, corpus poisoning, and access-control failures can create new reliability and security risks. Drawing on these findings, the article presents a literature-informed Cyber-RAG workflow with four stages: select authoritative and task-appropriate sources, retrieve and filter relevant evidence, generate a cited response, and check claim support together with date and version consistency.
Read the paper
Related studies
- Knowledge Management Perspective of Generative Artificial Intelligence
- Navigating Generative Artificial Intelligence Promises and Perils for Knowledge and Creative Work
- Characterizing the evolving research on enterprise content management
- Large language models and multimodal foundation models for precision oncology
- From Generative AI to Extended Reality: Multidisciplinary Perspectives on the Challenges, Opportunities, and Future of Educational Computing
- Generative Artificial Intelligence: A New Engine for Advancing Environmental Science and Engineering
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.