Large Language Models as a (Bad) Security Norm in the Context of Regulation and Compliance

Abstract

This paper examines the risks associated with deploying large language models in cybersecurity infrastructure development. The author reviews established cybersecurity norms and EU legal requirements, then analyses how LLM weaknesses conflict with both best practices and regulatory obligations. Key findings indicate that using LLMs comes with many risks, many of which are against good security practice and the legal obligations in security regulation such as the NIS2 Directive and Cyber Resilience Act. The analysis suggests symbolic AI presents fewer vulnerabilities and proposes secondary oversight systems and selective non-deployment as mitigation strategies.

Peer Review

Community peer review and discussion of this publication.