Skip to main content

Safe LLM Research Workflow

Purpose​

Define a safe workflow for using LLMs in public, defensive CTI research.

Practitioner-Level Explanation​

Safe LLM use starts with scope and data handling; use Customer project AI governance for delivery work. Public TLP:CLEAR material may be appropriate for external tools. Internal telemetry, credentials, victim data, proprietary reporting, or sensitive incident data should not be pasted into public models.

The model should be asked to produce structured claims, source links, confidence caveats, and gaps. The analyst verifies everything.

AI-Assisted CTI — Transition to Practical Workflow

Practical Workflow: Pre-Prompt Setup (6-step)

CTI Relevance​

This workflow lets teams gain speed without losing source integrity or data-handling discipline.

Common Mistakes​

  • Letting the model invent sources or facts.
  • Using AI output without source verification.
  • Putting sensitive or restricted data into public tools.
  • Skipping human analytic judgment.

Practical Workflow​

  1. Classify the data.
  2. Define task and allowed sources.
  3. Ask for structured output.
  4. Require evidence labels.
  5. Verify links and content.
  6. Downgrade unsupported claims.
  7. Record AI use if project policy requires it.

Practical Workflow: Research & Analysis with Rigor (6-step)

Example / Mini Case​

Prompt the model to extract claims from public reporting into a table: claim, source URL, evidence label, confidence, detection implication, gap. Then manually check each URL and claim before using it.

Analyst Checklist​

  • Are sources real and checked?
  • Are claims evidence-labeled?
  • Is sensitive data excluded?
  • Has a human reviewed the output?
  • Are hallucination controls applied?

Output Artifact​

Task:
Allowed Data:
Prompt Version:
Model Output:
Source Verification:
Claim Review:
Corrections:
Final Use:
Reviewer:

References​