From Hype to ROI: An Economic Model for LLM Adoption in Information Systems and Security Operations

Pellegrino Casoria; Andrea Araldo; Rosario Patanè; Simon Pietro Romano

cs.CROct 23, 2026

From Hype to ROI: An Economic Model for LLM Adoption in Information Systems and Security Operations

Authors: Pellegrino Casoria, Andrea Araldo, Rosario Patanè, Simon Pietro Romano

Organizations: University of Naples Federico II, Department of Electrical Engineering and Information Technology (DIETI), Naples, Italy · SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris, Palaiseau, France

Abstract

Large Language Models (LLMs) promise significant efficiency gains across information-intensive operations by automating repetitive language-based tasks. However, adoption decisions remain largely opportunistic, as organizations struggle to move from pilots to sustainable industrialization. Without systematic economic frameworks, practitioners cannot assess whether LLM investments create value in a given context. This paper develops a general economic model to support informed LLM adoption decisions in operational information systems. Facing high uncertainty, we represent parameters as random variables centered on authoritative benchmarks, and evaluate the model by Monte Carlo simulation across pessimistic-to-optimistic assumptions on LLM efficiency. The ROI distributions show the probability of profitability and the Value at Risk for each configuration, together with a sensitivity analysis of its main drivers. As a first instantiation, we apply the model to Security Operations Centers (SOCs), mapping workflows onto established standards to identify tasks suited to LLM augmentation. The model balances productivity gains, driven by alert volume, analyst effort, and LLM efficiency, against operational costs, including inference, infrastructure, and error remediation, covering both cloud API and self-hosted deployments. Results show that adoption economics are context-dependent, and that automation is an exploitable lever, gated by accuracy, while the cost of errors and the model's price are secondary. Across the analyzed models and prices, most configurations are unprofitable, with profitability limited to high-accuracy, low-uncertainty deployments. The model gives organizations a quantitative basis for evidence-based adoption decisions, by locating the boundary between profit and loss, and the loss risked beyond it.

Figures & tables

Figure 1: SOC incident response lifecycle

Level	Functions	Experience
L1	Procedural execution via documented playbooks	Entry-level (0–2 years)
L2	Analytical judgment and cross-system correlation	Mid-level (3–5 years)
L3	Deep technical analysis and specialized expertise	Senior / SME (6+ years)

Table 1: SOC Roles by functions and seniority

Symbol	Name	Unit	Constraint	Distr.	Sec.	Tab.
Model Instantiation
$\mathcal{R}$	Roles	—	$\|\mathcal{R}\|{=}3$	D	4.1	—
$\mathcal{A}$	Severity levels	—	$\|\mathcal{A}\|{=}3$	D	4.1	—
$\mathcal{K}$	Tasks	—	$\|\mathcal{K}\|{=}3$	D	4.1	—
$\mathcal{M}$	LLM archetypes	—	$\|\mathcal{M}\|{=}6$	D	4.1	—
Personnel Cost

Table 2: Model input parameters and their simulation setting. Distr.: B = Beta, G = Gamma, D = Deterministic.

	P10	P25	P50	P75
Base	36.1	47.0	62.1	78.6
Fully Loaded	51.6	67.3	88.8	112.4
$c_{L1}$	59.4
$c_{L2}$		78.0
$c_{L3}$			100.6

Table 3: Personnel Cost

c_{r}

(

/h) by SOC role. Source: BLS OEWS May 2025 (SOC 15-1212);

c_{r}$ : mean of the band’s FL percentiles.

Severity	Proportion	Alerts	TP Rate	Incidents
$a\in\mathcal{A}$	$p_{a}$	$p_{a}N$	$h_{a}$	$p_{a}h_{a}N$
Low	0.85	850	0.15	128
Medium	0.13	130	0.50	65
High	0.02	20	0.75	15
Total	—	1,000	—	208

Table 4: Alert volume

N

, alert distribution

p_{a}

and true-positive rate

h_{a}

. Baseline

N=1{,}000

alerts/day, critical incidents not in scope.

Severity	Effort $\tau_{k,a}$ (min)				Allocation $\alpha_{a,r}$
Severity	$\tau_{a}$	$\tau_{\text{tri},a}$	$\tau_{\text{ana},a}$	$\tau_{\text{doc},a}$	$\alpha_{a,L1}$	$\alpha_{a,L2}$	$\alpha_{a,L3}$
Low	10	2	5	3	0.8	0.2	0.0
Medium	30	6	15	9	0.5	0.5	0.0
High	60	12	30	18	0.1	0.6	0.3

Table 5: Per-alert effort

\tau_{k,a}

(min, converted to hours in the model) and role allocation

\alpha_{a,r}

by severity.

\tau_{a}=\sum_{k}\tau_{k,a}

and

\sum_{r}\alpha_{a,r}=1

ID	Benchmark	Ref	Type	Shared models
ID	Benchmark	Ref	Type	CSE	SB	CTI	CM	DF	CS
CSE	CyberSOCEval	[ 78 ]	CTI/Malw.	7	1	0	1	2	1
SB	SecBench	[ 79 ]	Know.	1	16	3	3	4	2
CTI	CTIBench	[ 80 ]	CTI	0	3	5	2	0	1
CM	CyberMetric	[ 81 ]	Know.	1	3	2	25	1	2
DF	DFIR-Metric	[ 82 ]	DFIR/IR	2	4	0	1	14	1

Table 6: Selected benchmarks: domain, reference, and shared-model overlap (blue heatmap; diagonal = models per benchmark, off-diagonal = models in common).

Archetype	$\boldsymbol{E^{m}}$	$\boldsymbol{\gamma^{m,\text{in}}}$	$\boldsymbol{\gamma^{m,\text{out}}}$	$\boldsymbol{\delta^{m}_{\text{tot}}}$	$\boldsymbol{\delta^{m}_{\text{act}}}$	$\boldsymbol{n^{m}_{\text{gpu}}}$
API-High (Grok-3)	0.92	$3	$15	–	–	–
API-Mid (gpt-4o-mini)	0.87	$0.15	$0.60	–	–	–
API-Low (claude-3-7-sonnet)	0.58	$3	$15	–	–	–
SH-High (Falcon-180B-Chat)	0.88	–	–	180	180	5
SH-Mid (Qwen-1.5-MoE-A2.7B-Chat)	0.75	–	–	14	2.7	1
SH-Low (llama-3-8b)	0.45	–	–	8	8	1

Table 7: Illustrative LLM archetypes and their simulation parameters.

n^{m}_{\text{gpu}}

is the number of H100s to serve each model per Eq. ( 10 ).

Severity $a$	Requests $\mathit{req}_{a}$	Input $\mathit{tok}^{\mathrm{in}}_{a}$	Output $\mathit{tok}^{\mathrm{out}}_{a}$
Low	5	8K	2K
Medium	10	12K	3K
High	15	16K	4K

Table 8: Simulation values for the per-severity inference parameters (

\mathit{req}_{a}

\mathit{tok}^{\mathrm{in}}_{a}

\mathit{tok}^{\mathrm{out}}_{a}

), at a 4:1 input-to-output ratio.

Figure 2: Probability that adoption is profitable $P(\mathrm{ROI}>0)$ , as $\theta$ and CV vary. Rows: scenario $(\bar{\eta},\bar{\beta})$ . Shaded band: $P\geq 0.8$ .

Figure 3: $P(\mathrm{ROI}>0)$ as the daily alert volume $N$ (log scale) varies, per archetype. $\bar{\theta}{=}10\%$ , $\bar{\eta}{=}0.75$ , $\bar{\beta}{=}0$ , CV ${=}5\%$ . Dashed line: baseline $\bar{N}{=}1000$ .

Figure 4: Example cost with LLM $C^{m}$ as % of the no-LLM baseline $C^{\mathrm{noLLM}}$ . $\bar{\theta}{=}10\%$ , $\bar{\beta}{=}\bar{\eta}$ , CV ${=}5\%$ , $\bar{N}{=}1000$ . Whiskers: 10–90 percentile.

Figure 5: Downside risk of adoption $\mathrm{VaR}_{10\%}(\mathrm{ROI})$ (worst-decile loss), as $\theta$ and CV vary. Rows: mode $(\bar{\eta},\bar{\beta})$ . Col.: archetypes $(\bar{E}^{m})$ .

Figure 6: Profit region in the $(\bar{E}^{m},\bar{\eta})$ plane; $C^{m}_{\text{tech}}=0$ , $\mathrm{CV}=5\%$ , $\bar{\theta}=10\%$ . Dash-dot lines: archetypes, coded by deployment (A: API, S: self-hosted) and accuracy tier (H/M/L).

Figure 7: ROI sensitivity analysis per archetype, as deviation from the baseline operating point ( $\bar{\eta}=\bar{\beta}=0.75$ , $\bar{\theta}=10\%$ , $\bar{N}=1000$ ); shared normalized scale, $0$ = baseline; green above baseline, red below.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Model	Provider	Deploy Mode	$\boldsymbol{\gamma^{m,\text{in}}}$	$\boldsymbol{\gamma^{m,\text{out}}}$	$\boldsymbol{\delta^{m}_{\text{tot}}}$	$\boldsymbol{\delta^{m}_{\text{act}}}$	$\boldsymbol{E^{m}}$	Ref.
Hunyuan-Turbo	Tencent	API	$0.33	$1.33	–	–	94%	[ 79 ]
gpt-4.1	OpenAI	API	$2.00	$8.00	–	–	93%	[ 82 ]
gpt-4-turbo	OpenAI	API	$10.00	$30.00	–	–	92%	[ 81 ]
Grok-3	xAI	API	$3.00	$15.00	–	–	92%	[ 82 ]
DeepSeek-V3	DeepSeek	API	$0.27	$1.10	–	–	91%	[ 79 , 82 ]
o1-mini	OpenAI	API	$1.10	$4.40	–	–	91%	[ 79 ]

Appendix

Table 9: LLM pricing, size and cybersecurity benchmark accuracy. 71 distinct models (73 rows): DeepSeek-V3 and DeepSeek-R1 evaluated under both API and self-hosted deployment.

Organizational AI Adoption

See all 18 papers

Aug 1, 2026

From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness

Security Operations Centers (SOCs) process large volumes of security events, requiring analysts to accurately detect and assess ongoing cyberattacks under time pressure. Recent advances in Large Language Models (LLMs) suggest potential benefits for security operations, yet their practical suitability for real-world SOC workflows remains poorly understood. To address this gap, we conducted 25 semi-structured interviews with SOC practitioners who had prior experience with LLMs, complemented by interactive scenarios to anticipate challenges and identify opportunities for the responsible integration of LLM-based tools into SOC workflows. We identified 15 LLM use cases grouped into six functional categories. While LLMs are valued for automating repetitive, low-level tasks such as report automation, practitioners rate high-impact tasks such as incident analysis as not yet feasible, reporting limitations in technical depth, context awareness, and organization-specific knowledge. They locate these limitations less in the models than in the readiness of their SOCs and human factors driving over-reliance. Despite concerns, practitioners express a strong willingness to adopt LLMs, describing competitive pressure that leaves few alternatives. This work contributes an empirical, practitioner-driven analysis of LLM use across SOC roles and organizations and derives concrete design and integration requirements for human-centered, operationally safe LLM-assisted security operations.

Jonas Thurner, Nadine Jost, Stefan Albert Horstmann +4

FH Münster, Germany · Ruhr University Bochum, Germany · University of Cologne, Germany +2

Cybersecurity LLMs for Cybersecurity

Ask PDF

Apr 11, 2026

Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit

Large language models (LLMs) have recently emerged as promising tools for augmenting Security Operations Center (SOC) workflows, with vendors increasingly marketing autonomous AI solutions for SOCs. However, there remains a limited empirical understanding of how such tools are used, perceived, and adopted by real-world security practitioners. To address this gap, we conduct a mixed-methods analysis of discussions in cybersecurity-focused forums to learn how a diverse group of practitioners use and perceive modern LLM tools for security operations. More specifically, we analyzed 892 posts between December 2022 and September 2025 from three cybersecurity-focused forums on Reddit, and, using a combination of qualitative coding and statistical analysis, examined how security practitioners discuss LLM tools across three dimensions: (1) their stated tools and use cases, (2) the perceived pros and cons of each tool across a set of critical factors, and (3) their adoption of such tools and the expected impacts on the cybersecurity industry and individual analysts. Overall, our findings reveal nuanced patterns in LLM tools adoption, highlighting independent use of LLMs for low-risk, productivity-oriented tasks, alongside active interest around enterprise-grade, security-focused LLM platforms. Although practitioners report meaningful gains in efficiency and effectiveness in LLM-assisted workflows, persistent issues with reliability, verification overheads, and security risks sharply constrain the autonomy granted to LLM tools. Based on these results, we also provide recommendations for developing and adopting LLM tools to ensure the security of organizations and the safety of cybersecurity practitioners.

Souradip Nath, Chih-Yi Huang, Aditi Ganapathi +3

Arizona State University · Technische Universität Berlin

LLMs for Cybersecurity Cybersecurity LLM Reliability

Ask PDF

Apr 21, 2026

Are Large Language Models Economically Viable for Industry Deployment?

Generative AI-powered by Large Language Models (LLMs)-is increasingly deployed in industry across healthcare decision support, financial analytics, enterprise retrieval, and conversational automation, where reliability, efficiency, and cost control are critical. In such settings, models must satisfy strict constraints on energy, latency, and hardware utilization-not accuracy alone. Yet prevailing evaluation pipelines remain accuracy-centric, creating a Deployment-Evaluation Gap-the absence of operational and economic criteria in model assessment. To address this gap, we present EDGE-EVAL-a industry-oriented benchmarking framework that evaluates LLMs across their full lifecycle on legacy NVIDIA Tesla T4 GPUs. Benchmarking LLaMA and Qwen variants across three industrial tasks, we introduce five deployment metrics-Economic Break-Even (Nbreak), Intelligence-Per-Watt (IPW ), System Density (\r{ho}sys), Cold-Start Tax (Ctax), and Quantization Fidelity (Qret)-capturing profitability, energy efficiency, hardware scaling, serverless feasibility, and compression safety. Our results reveal a clear efficiency frontier-models in the <2B parameter class dominate larger baselines across economic and ecological dimensions. LLaMA-3.2-1B (INT4) achieves ROI break-even in 14 requests (median), delivers 3x higher energy-normalized intelligence than 7B models, and exceeds 6,900 tokens/s/GB under 4-bit quantization. We further uncover an efficiency anomaly-while QLoRA reduces memory footprint, it increases adaptation energy by up to 7x for small models-challenging prevailing assumptions about quantization-aware training in edge deployment.

Abdullah Mohammad, Sushant Kumar Ray, Pushkar Arora +5

DSEU-Okhla, New Delhi, India · University of Delhi, New Delhi, India · 6, 8Macquarie University, Sydney, Australia +1

LLM Inference Efficiency LLM Evaluation Cost-Aware Inference

Ask PDF

Abstract

Organizational AI Adoption

Explore similar work

From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness

Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit

Are Large Language Models Economically Viable for Industry Deployment?