LLMs for Zero-Shot Threat Detection via Structured Risk Indicators
It is shown that the quality of the generated risk indicators is the main driver of zero-shot cyber threat detection performance, and that retrieval mainly benefits weaker LLMs by generating more discriminative risk indicators, whereas stronger models achieve comparable performance without retrieved context.