Retrieval-Augmented Generation for Cybersecurity Analysis: A Focused Narrative Review and Security-Controlled Workflow
DOI:
https://doi.org/10.56158/jcosml.2026.1.1.7Keywords:
retrieval augmented generation, large language models, cybersecurity, hallucination mitigation, prompt injection and corpus poisoningAbstract
Retrieval-augmented generation (RAG) enables large language models (LLMs) to consult external evidence when answering questions. This capability is attractive in cybersecurity, where vulnerability records, exploitation status, threat intelligence, and defensive guidance change frequently. This focused narrative review examines how RAG has been applied to cybersecurity knowledge assistance, vulnerability analysis, threat-intelligence investigation, attack attribution, technique mapping, and incident analysis. The reviewed literature indicates that RAG may reduce unsupported claims by moving volatile facts from parametric memory to an inspectable evidence channel, but retrieval alone does not guarantee correctness. Irrelevant or outdated passages, unsupported citations, conflicting reports, indirect prompt injection, corpus poisoning, and access-control failures can create new reliability and security risks. Drawing on these findings, the article presents a literature-informed Cyber-RAG workflow with four stages: select authoritative and task-appropriate sources, retrieve and filter relevant evidence, generate a cited response, and check claim support together with date and version consistency.
References
[1] Y. Gao, Y. Xiong, X. Gao, K. Jia, J. Pan, Y. Bi, Y. Dai, J. Sun, M. Wang, and H. Wang, “Retrieval-Augmented Generation for Large Language Models: A Survey,” arXiv:2312.10997, ver. 5, 2024. doi: 10.48550/arXiv.2312.10997. [Preprint].
[2] W. Fan et al., “A survey on RAG meeting LLMs: Towards retrieval-augmented large language models,” in Proc. 30th ACM SIGKDD Conf. Knowledge Discovery and Data Mining, pp. 6491–6501, 2024. doi: 10.1145/3637528.3671470.
[3] K. Greshake et al., “Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection,” in Proc. 16th ACM Workshop on Artificial Intelligence and Security, pp. 79–90, 2023. doi: 10.1145/3605764.3623985.
[4] W. Zou et al., “PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models,” in Proc. 34th USENIX Security Symposium, pp. 3827–3844, 2025.
[5] Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases,” in Advances in Neural Information Processing Systems, vol. 37, pp. 130185–130213, 2024. doi: 10.52202/079017-4136.
[6] A. Asai, Z. Wu, Y. Wang, A. Sil, and H. Hajishirzi, “Self-RAG: Learning to retrieve, generate, and critique through self-reflection,” in Proc. Int. Conf. Learning Representations, 2024.
[7] Z. Jiang, F. F. Xu, L. Gao, Z. Sun, Q. Liu, J. Dwivedi-Yu, Y. Yang, J. Callan, and G. Neubig, “Active retrieval augmented generation,” in Proc. 2023 Conf. Empirical Methods in Natural Language Processing, pp. 7969–7992, 2023. doi: 10.18653/v1/2023.emnlp-main.495.
[8] S. Jeong, J. Baek, S. Cho, S. J. Hwang, and J. C. Park, “Adaptive-RAG: Learning to adapt retrieval-augmented large language models through question complexity,” in Proc. 2024 Conf. North American Chapter of the Association for Computational Linguistics, pp. 7036–7050, 2024. doi: 10.18653/v1/2024.naacl-long.389.
[9] C. Niu, Y. Wu, J. Zhu, S. Xu, K. Shum, R. Zhong, J. Song, and T. Zhang, “RAGTruth: A hallucination corpus for developing trustworthy retrieval-augmented language models,” in Proc. 62nd Annual Meeting of the Association for Computational Linguistics, pp. 10862–10878, 2024. doi: 10.18653/v1/2024.acl-long.585.
[10] J. Saad-Falcon, O. Khattab, C. Potts, and M. Zaharia, “ARES: An automated evaluation framework for retrieval-augmented generation systems,” in Proc. 2024 Conf. North American Chapter of the Association for Computational Linguistics, pp. 338–354, 2024. doi: 10.18653/v1/2024.naacl-long.20.
[11] S. Es, J. James, L. Espinosa-Anke, and S. Schockaert, “RAGAs: Automated evaluation of retrieval augmented generation,” in Proc. 18th Conf. European Chapter of the Association for Computational Linguistics: System Demonstrations, pp. 150–158, 2024. doi: 10.18653/v1/2024.eacl-demo.16.
[12] P. Manakul, A. Liusie, and M. J. F. Gales, “SelfCheckGPT: Zero-resource black-box hallucination detection for generative large language models,” in Proc. 2023 Conf. Empirical Methods in Natural Language Processing, pp. 9004–9017, 2023. doi: 10.18653/v1/2023.emnlp-main.557.
[13] S. Min et al., “FActScore: Fine-grained atomic evaluation of factual precision in long form text generation,” in Proc. 2023 Conf. Empirical Methods in Natural Language Processing, pp. 12076–12100, 2023. doi: 10.18653/v1/2023.emnlp-main.741.
[14] F. S. Bao et al., “FaithBench: A diverse hallucination benchmark for summarization by modern LLMs,” in Proc. 2025 Conf. Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies, vol. 2, Short Papers, pp. 448–461, 2025. doi: 10.18653/v1/2025.naacl-short.38.
[15] K. Zhu et al., “RAGEval: Scenario specific RAG evaluation dataset generation framework,” in Proc. 63rd Annual Meeting of the Association for Computational Linguistics, pp. 8520–8544, 2025. doi: 10.18653/v1/2025.acl-long.418.
[16] S. Barnett, S. Kurniawan, S. Thudumu, Z. Brannelly, and M. Abdelrazek, “Seven failure points when engineering a retrieval augmented generation system,” in Proc. IEEE/ACM 3rd Int. Conf. AI Engineering—Software Engineering for AI, pp. 194–199, 2024. doi: 10.1145/3644815.3644945.
[17] N. Tihanyi et al., “CyberMetric: A benchmark dataset based on retrieval-augmented generation for evaluating LLMs in cybersecurity knowledge,” in Proc. IEEE Int. Conf. Cyber Security and Resilience, pp. 296–302, 2024. doi: 10.1109/CSR61664.2024.10679494.
[18] M. Simoni, A. Saracino, V. Puthuvath, and M. Conti, “MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generation,” in Proc. 40th ACM/SIGAPP Symposium on Applied Computing, pp. 1213–1222, 2025. doi: 10.1145/3672608.3707898.
[19] S. Rajapaksha, R. Rani, and E. Karafili, “A RAG-Based Question-Answering Solution for Cyber-Attack Investigation and Attribution,” in Computer Security—ESORICS 2024 International Workshops, LNCS 15264, pp. 238–256, 2025. doi: 10.1007/978-3-031-82362-6_15.
[20] A. Alhuzali, “LLM-powered threat intelligence: A retrieval-augmented generation approach for cyber attack investigation,” PeerJ Computer Science, vol. 11, e3371, 2025. doi: 10.7717/peerj-cs.3371.
[21] F. Yu and Y. Du, “VDM-IOG, a framework of inference on graph in retrieval-augmented generation for vulnerability description mapping,” Cybersecurity, vol. 9, art. no. 14, 2026. doi: 10.1186/s42400-025-00413-1.
[22] X. Cadet, A. V. Singh, H. Mamania, E. Koh, A. Fitts, D. Van Bruggen, S. Boboila, P. Chin, and A. Oprea, “Retrieval-augmented LLMs for security incident analysis,” in Proc. ACM Conference on AI and Agentic Systems, pp. 103–123, 2026. doi: 10.1145/3786335.3813136.
[23] B. An, S. Zhang, and M. Dredze, “RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models,” in Proc. 2025 Conf. Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies, pp. 5444–5474, 2025. doi: 10.18653/v1/2025.naacl-long.281.
[24] B. Zhang, H. Xin, M. Fang, Z. Liu, B. Yi, T. Li, and Z. Liu, “Traceback of Poisoning Attacks to Retrieval-Augmented Generation,” in Proc. ACM Web Conference 2025, pp. 2085–2097, 2025. doi: 10.1145/3696410.3714756.
[25] M. Kim, H. Lee, and H. Koo, “Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems,” in Proc. 2025 Annual Computer Security Applications Conference, pp. 1178–1192, 2025. doi: 10.1109/ACSAC67867.2025.00093.
[26] National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, 2024. doi: 10.6028/NIST.AI.600-1.
[27] OWASP Foundation, “LLM01:2025 Prompt Injection,” OWASP Top 10 for Large Language Model Applications, 2025. [Online]. Available: https://genai.owasp.org/llmrisk/llm01-prompt-injection/. [Accessed: Aug. 26, 2026].
[28] MITRE, “ATT&CK Data & Tools.” [Online]. Available: https://attack.mitre.org/resources/attack-data-and-tools/. [Accessed: Aug. 26, 2026].
[29] National Institute of Standards and Technology, “National Vulnerability Database: Vulnerability APIs.” [Online]. Available: https://nvd.nist.gov/developers/vulnerabilities. [Accessed: Aug. 26, 2026].
[30] Cybersecurity and Infrastructure Security Agency, “Known Exploited Vulnerabilities Catalog.” [Online]. Available: https://www.cisa.gov/known-exploited-vulnerabilities-catalog. [Accessed: Aug. 26, 2026].
[31] OASIS Open, STIX Version 2.1, B. Jordan, R. Piazza, and T. Darley, eds., OASIS Standard, Jun. 10, 2021. [Online]. Available: https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html. [Accessed: Aug. 26, 2026].
[32] OASIS Open, TAXII Version 2.1, B. Jordan and D. Varner, eds., OASIS Standard, Jun. 10, 2021. [Online]. Available: https://docs.oasis-open.org/cti/taxii/v2.1/os/taxii-v2.1-os.html. [Accessed: Aug. 26, 2026].
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Mustafa Furkan Ceylan (Author)
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
