Yes, but as an assistant to your analysts, not as a detector. A large language model running on your own hardware can summarise an incident, write the query an analyst needs and draft the incident report, all without sending security logs outside the company. It can't replace the detection your firewall, endpoint tools and SIEM already do. Published benchmarks show today's models are well short of reliable on hard security analysis. The biggest new risk is prompt injection, where an attacker writes instructions into a log field and the model obeys them. The best-studied example found a popular open model, the kind most companies would run locally, was the easiest to fool. Local AI is a data-control choice, not a security guarantee.
The AI built into firewalls and threat-intelligence services is a different topic, covered in AI vs AI: FortiGate and FortiGuard. This post is about a self-hosted model working on your own logs.
What can a local LLM actually do for a security team?
Three jobs fit well. The first is triage summaries: turning a cluster of related alerts into a plain-language account of what happened and when. The second is query writing: translating "show me every failed admin login from outside Singapore this week" into the syntax your log platform uses. The third is incident write-ups: drafting the timeline and summary an analyst then checks and signs off. In each case the model works on material that detection systems have already flagged and filtered, and a person makes the decision.
What it shouldn't do is decide on its own that an alert is harmless, or take actions such as blocking an address or disabling an account without approval. Those are the cases where a wrong or manipulated answer does real damage.
What does the evidence say about LLMs in security operations?
| Study | Who and when | What was tested | Result | Caveat |
|---|---|---|---|---|
| CyberSOCEval (malware) | Meta and CrowdStrike, Sep 2025 | 609 questions on sandbox detonation reports | About 23–34% accuracy | Benchmark; reasoning models gave no large boost |
| CyberSOCEval (threat intel) | Meta and CrowdStrike, Sep 2025 | 588 questions from 45 threat reports | About 43–53% accuracy | Benchmark, not live operations |
| SOC productivity study | Microsoft researchers, Nov 2024 | Live Defender XDR telemetry, 89 adopters vs 88 controls | 30.13% lower mean time to resolve at month 3 | Vendor-authored; observational, not causal |
| Poisoning the Watchtower | Preprint, May 2026 | Injected instructions in log fields, gpt-4o-mini as analyst | 26.6% average success; 11.8% with the strongest defence | Not peer-reviewed |
| LogJack | Preprint, Apr 2026 | 8 models reading poisoned cloud logs | From 0% (Claude Sonnet 4.6) to 86.2% (Llama 3.3 70B) executed the injected command | Not peer-reviewed; agent setting |
| Log-file prompt injection proofs of concept | LevelBlue SpiderLabs, Sep 2025 | User-Agent, SSH username and Windows event fields | Model reported a false source IP and host | Vendor research |
Source: CyberSOCEval (arXiv 2509.20166, rev. 6 Nov 2025); Bono, Grana and Xu, Microsoft (arXiv 2411.03116, Nov 2024); Pandey and Bhujang (arXiv 2605.24421, 23 May 2026); Shah, LogJack (arXiv 2604.15368, 15 Apr 2026); LevelBlue SpiderLabs blog (5 Sep 2025). Results as reported by each source, compiled 9 Nov 2026.
The CyberSOCEval authors note that "current LLMs are far from saturating our evaluations". They also found that an abridged report "does not meaningfully affect performance", which supports giving the model filtered material rather than everything.
Why keep security logs on your own hardware?
Security logs are full of personal data: usernames, email addresses, IP addresses and device names. That brings them under the PDPA's protection and transfer obligations, so sending them to an overseas AI service needs the same transfer analysis as any other personal data. Owners of critical information infrastructure have a further reason. The 2024 amendment to the Cybersecurity Act widened incident reporting to cover incidents in supply chains, and every external service you add becomes part of that chain. Running the model locally keeps the logs, the prompts and the model's answers inside your own environment.
Can one GPU read all your logs?
No, and it shouldn't try. Here is a worked example with assumptions stated. A mid-size site logging 500 events a second at about 600 bytes each produces about 25.9 GB of logs a day. At roughly 4 characters per token, that's about 6.5 billion tokens a day; log text with IP addresses and hex strings often tokenises worse. One NVIDIA RTX PRO 6000 running gpt-oss-120b processed prompts at about 3,500 tokens a second at 12K context in a published test. That's about 302 million tokens a day, or roughly 5% of the raw volume (CALC, illustrative; the event rate and size are assumptions, not measurements).
The design follows from the arithmetic. Detection stays with the SIEM, log analyser or firewall service, and the model reads alerts, correlated incidents and the extracts an analyst selects. That is also the workload the benchmarks suggest models handle best.
Treat every log line as attacker-controlled input. A local model keeps your logs in-house. It doesn't make them trustworthy.
Is a local model safer against prompt injection?
Not by default. In the LogJack tests, Llama 3.3 70B was the most likely of the eight models to execute an injected command, at 86.2%, and a curl-to-bash remote-code-execution payload worked on six of eight models. Cloud prompt filters did little better: Azure Prompt Shield flagged 1 of 32 payloads and Google's Model Armor flagged none. The fixes are architectural rather than a choice of model:
- Read-only access. Give the assistant permission to read logs and propose queries, not to run commands or change configurations. OWASP lists "excessive agency" as a top risk for LLM applications.
- Least privilege and no admin by default, as CSA's June 2026 addendum on securing agentic AI recommends (2.8).
- Guardrails against indirect injection through data the model reads (CSA addendum 4.1). The PDPC's 2026 generative AI guidelines also name prompt injection.
- Log the assistant's own activity to your SIEM (CSA addendum 4.3).
- A human approves every action (CSA addendum 4.4).
The wider security risks of AI assistants are covered in why your AI assistant may be your biggest security risk. For a fully isolated setup, see running an AI workstation without internet access.
What hardware fits which security team?
A small team can run an analyst assistant on a compact system with 128 GB of memory. That handles a capable open model and a search index over recent incidents. A larger team, or one that wants the assistant to run around the clock, needs a workstation with a professional GPU or a GPU server, plus fast storage for the hot log window. Our post on running AI agents unattended covers what changes when it runs all day. The assistant only works if detection underneath it does, so keep firewall security services current. Our post on running a FortiGate without FortiGuard explains what you lose if they lapse. The right size depends on your log volume, retention period and how many analysts use the assistant at once.
This article is general information, not legal, medical or compliance advice. Check current CSA and PDPC guidance and your own regulatory obligations before deploying.
Buying in Singapore
For the assistant itself, the ASUS Ascent GX10 64GB (S$6,670) and the NVIDIA DGX Spark 4TB (S$9,300) suit small teams. For a hot log store, the Micron 9550 PRO 7.68TB (S$10,456) is fast NVMe, and the Synology DS1823xs+ (S$2,844) holds the archive. On the network side, the FortiGate 90G (from S$3,796.80) and FortiGate 120G (S$5,732.40) generate the logs. Check which security services each quote includes. Microsoft Defender for Endpoint P2 is S$80 for a 12-month licence (listed 9 Nov 2026; prices change; ask for a current quotation). GPU servers for SOC-scale work, such as the Lenovo ThinkSystem SR650a V4, are price on request. Ask us about FortiAnalyzer, FortiSIEM or other SIEM platforms, which we don't list. To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Can a local LLM replace our SIEM? No. Detection should stay with your SIEM, log analyser, endpoint tools and firewall services. A local model helps analysts summarise incidents, write queries and draft reports from material those systems have already flagged.
How accurate are LLMs at security analysis? Not very, yet. In CyberSOCEval (Meta and CrowdStrike, 2025), models scored about 23–34% on malware-analysis questions and 43–53% on threat-intelligence questions, and the authors said models were far from saturating the tests.
What is prompt injection through logs? An attacker puts instructions into a field your systems log, such as a username or User-Agent. When an AI assistant reads the log, it may follow those instructions, for example reporting a false source IP or running a command.
Is an open-source model run locally safer? Not automatically. In the LogJack preprint (April 2026), Llama 3.3 70B executed injected commands in 86.2% of tests, the highest of eight models. Safety comes from read-only access, least privilege and human approval.
Why not send security logs to a cloud AI service? Logs contain personal data such as usernames and IP addresses, so PDPA protection and transfer rules apply. Critical infrastructure owners also have supply-chain incident duties under the amended Cybersecurity Act. A local model keeps logs in-house.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
