LLMs in Cybersecurity: Reading Past the 50% Malware Claim

A new survey claims LLM-generated malware will account for 50% of detected threats in 2025, up from just 2% in 2021 — and that projection is doing more work than any evidence behind it. The paper, a synthesis of over 70 academic papers, industry reports, and technical documents, is genuinely useful as a map of the dual-use landscape. But the headline number deserves the skepticism its own methodology can't fully supply.

What The Numbers Actually Show

The 50% figure is a projection, not a measurement. The source material doesn't describe how it was derived — no baseline methodology, no detection criteria, no breakdown of what counts as "LLM-generated" versus malware written with incidental LLM assistance. That distinction matters enormously: a threat actor using an LLM to obfuscate code is different from malware conceptually authored by a model, and detection systems don't currently distinguish them in any consistent way.

What the paper does document more solidly is the defensive side. Models like VulBERTa are being fine-tuned to identify zero-day vulnerabilities and outperforming traditional static analyzers. Platform administrators — Google Play, Apple App Store, enterprise app platforms — can use LLMs for automated code scanning and real-time threat detection. These are concrete, testable claims with visible deployments behind them.

The Same Tool, Both Directions

The survey's central observation is that the same capabilities cut both ways: models that empower defenders to "perform static code scanning, automate threat detection" are simultaneously exploited by attackers to generate malware, obfuscate code, and discover vulnerabilities at scale. This isn't a novel insight — dual-use dynamics predate LLMs — but the paper frames it usefully through specific mechanisms: DevSecOps automation that speeds secure development also accelerates insecure development; vulnerability discovery tools don't check who's holding them.

The proposed governance roadmap leans on explainability, privacy-by-design, federated learning, and compliance. Federated learning in particular gets attention as a way to deploy LLMs across distributed devices without centralizing data — a real architectural answer to a real privacy problem.

Where The Roadmap Stops Short

Here's what's missing from this account: a governance roadmap built on explainability and compliance assumes attackers operate inside systems that can be governed. They don't. The defensive recommendations address how organizations deploy LLMs; they say little about how to defend against LLM capabilities that are already commodity-priced and publicly available. The gap between "our deployment is privacy-preserving" and "our perimeter withstands machine-generated attacks at scale" is where the actual risk lives.

The real story here isn't the 50% projection — it's that offense and defense are now iterating on the same models at the same speed, which compresses the window defenders traditionally had to patch against new techniques. That's an interpretation, not something the paper measures directly. But it's what the material points toward: when VulBERTa finds zero-days faster than static analyzers, someone else is fine-tuning an equivalent model to find them first.

The honest read: this survey is worth consulting as a structured overview of LLM applications across cybersecurity — both beneficial and malicious — and its federated learning discussion is genuinely substantive. Treat its projections as directional signals requiring verification, not established facts. A paper reviewing 70 sources should be read with exactly that much care.