Six-Month SOC Ethnography Reveals LLM Adoption Barriers: Trust, Hallucinations, and Inconsistent Outputs

arXiv·medium signalXBlueskyLinkedInCopy link

Two PhD researchers embedded in a multinational company's Security Operations Center for six months of ethnographic fieldwork to assess whether LLM-based tools can improve SOC efficiency. They identified recurring pain points where LLMs could help but found that hallucinations and inconsistent outputs amplify existing trust barriers that have historically slowed technology adoption in security operations. This is the most rigorous study to date on real-world LLM integration in cybersecurity workflows.