From Hype to ROI: An Economic Model for LLM Adoption in Information Systems and Security Operations

Pellegrino Casoria; Andrea Araldo; Rosario Patanè; Simon Pietro Romano

cs.CROct 23, 2026

From Hype to ROI: An Economic Model for LLM Adoption in Information Systems and Security Operations

Authors: Pellegrino Casoria, Andrea Araldo, Rosario Patanè, Simon Pietro Romano

Organizations: University of Naples Federico II, Department of Electrical Engineering and Information Technology (DIETI), Naples, Italy · SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris, Palaiseau, France

Abstract

Large Language Models (LLMs) promise significant efficiency gains across information-intensive operations by automating repetitive language-based tasks. However, adoption decisions remain largely opportunistic, as organizations struggle to move from pilots to sustainable industrialization. Without systematic economic frameworks, practitioners cannot assess whether LLM investments create value in a given context. This paper develops a general economic model to support informed LLM adoption decisions in operational information systems. Facing high uncertainty, we represent parameters as random variables centered on authoritative benchmarks, and evaluate the model by Monte Carlo simulation across pessimistic-to-optimistic assumptions on LLM efficiency. The ROI distributions show the probability of profitability and the Value at Risk for each configuration, together with a sensitivity analysis of its main drivers. As a first instantiation, we apply the model to Security Operations Centers (SOCs), mapping workflows onto established standards to identify tasks suited to LLM augmentation. The model balances productivity gains, driven by alert volume, analyst effort, and LLM efficiency, against operational costs, including inference, infrastructure, and error remediation, covering both cloud API and self-hosted deployments. Results show that adoption economics are context-dependent, and that automation is an exploitable lever, gated by accuracy, while the cost of errors and the model's price are secondary. Across the analyzed models and prices, most configurations are unprofitable, with profitability limited to high-accuracy, low-uncertainty deployments. The model gives organizations a quantitative basis for evidence-based adoption decisions, by locating the boundary between profit and loss, and the loss risked beyond it.

Figures & tables

Figure 1: SOC incident response lifecycle

Level	Functions	Experience
L1	Procedural execution via documented playbooks	Entry-level (0–2 years)
L2	Analytical judgment and cross-system correlation	Mid-level (3–5 years)
L3	Deep technical analysis and specialized expertise	Senior / SME (6+ years)

Table 1: SOC Roles by functions and seniority

Symbol	Name	Unit	Constraint	Distr.	Sec.	Tab.
Model Instantiation
$\mathcal{R}$	Roles	—	$\|\mathcal{R}\|{=}3$	D	4.1	—
$\mathcal{A}$	Severity levels	—	$\|\mathcal{A}\|{=}3$	D	4.1	—
$\mathcal{K}$	Tasks	—	$\|\mathcal{K}\|{=}3$	D	4.1	—
$\mathcal{M}$	LLM archetypes	—	$\|\mathcal{M}\|{=}6$	D	4.1	—
Personnel Cost

Table 2: Model input parameters and their simulation setting. Distr.: B = Beta, G = Gamma, D = Deterministic.

	P10	P25	P50	P75
Base	36.1	47.0	62.1	78.6
Fully Loaded	51.6	67.3	88.8	112.4
$c_{L1}$	59.4
$c_{L2}$		78.0
$c_{L3}$			100.6

Table 3: Personnel Cost

c_{r}

(

/h) by SOC role. Source: BLS OEWS May 2025 (SOC 15-1212);

c_{r}$ : mean of the band’s FL percentiles.

Severity	Proportion	Alerts	TP Rate	Incidents
$a\in\mathcal{A}$	$p_{a}$	$p_{a}N$	$h_{a}$	$p_{a}h_{a}N$
Low	0.85	850	0.15	128
Medium	0.13	130	0.50	65
High	0.02	20	0.75	15
Total	—	1,000	—	208

Table 4: Alert volume

N

, alert distribution

p_{a}

and true-positive rate

h_{a}

. Baseline

N=1{,}000

alerts/day, critical incidents not in scope.

Severity	Effort $\tau_{k,a}$ (min)				Allocation $\alpha_{a,r}$
Severity	$\tau_{a}$	$\tau_{\text{tri},a}$	$\tau_{\text{ana},a}$	$\tau_{\text{doc},a}$	$\alpha_{a,L1}$	$\alpha_{a,L2}$	$\alpha_{a,L3}$
Low	10	2	5	3	0.8	0.2	0.0
Medium	30	6	15	9	0.5	0.5	0.0
High	60	12	30	18	0.1	0.6	0.3

Table 5: Per-alert effort

\tau_{k,a}

(min, converted to hours in the model) and role allocation

\alpha_{a,r}

by severity.

\tau_{a}=\sum_{k}\tau_{k,a}

and

\sum_{r}\alpha_{a,r}=1

ID	Benchmark	Ref	Type	Shared models
ID	Benchmark	Ref	Type	CSE	SB	CTI	CM	DF	CS
CSE	CyberSOCEval	[ 78 ]	CTI/Malw.	7	1	0	1	2	1
SB	SecBench	[ 79 ]	Know.	1	16	3	3	4	2
CTI	CTIBench	[ 80 ]	CTI	0	3	5	2	0	1
CM	CyberMetric	[ 81 ]	Know.	1	3	2	25	1	2
DF	DFIR-Metric	[ 82 ]	DFIR/IR	2	4	0	1	14	1

Table 6: Selected benchmarks: domain, reference, and shared-model overlap (blue heatmap; diagonal = models per benchmark, off-diagonal = models in common).

Archetype	$\boldsymbol{E^{m}}$	$\boldsymbol{\gamma^{m,\text{in}}}$	$\boldsymbol{\gamma^{m,\text{out}}}$	$\boldsymbol{\delta^{m}_{\text{tot}}}$	$\boldsymbol{\delta^{m}_{\text{act}}}$	$\boldsymbol{n^{m}_{\text{gpu}}}$
API-High (Grok-3)	0.92	$3	$15	–	–	–
API-Mid (gpt-4o-mini)	0.87	$0.15	$0.60	–	–	–
API-Low (claude-3-7-sonnet)	0.58	$3	$15	–	–	–
SH-High (Falcon-180B-Chat)	0.88	–	–	180	180	5
SH-Mid (Qwen-1.5-MoE-A2.7B-Chat)	0.75	–	–	14	2.7	1
SH-Low (llama-3-8b)	0.45	–	–	8	8	1

Table 7: Illustrative LLM archetypes and their simulation parameters.

n^{m}_{\text{gpu}}

is the number of H100s to serve each model per Eq. ( 10 ).

Severity $a$	Requests $\mathit{req}_{a}$	Input $\mathit{tok}^{\mathrm{in}}_{a}$	Output $\mathit{tok}^{\mathrm{out}}_{a}$
Low	5	8K	2K
Medium	10	12K	3K
High	15	16K	4K

Table 8: Simulation values for the per-severity inference parameters (

\mathit{req}_{a}

\mathit{tok}^{\mathrm{in}}_{a}

\mathit{tok}^{\mathrm{out}}_{a}

), at a 4:1 input-to-output ratio.

Figure 2: Probability that adoption is profitable $P(\mathrm{ROI}>0)$ , as $\theta$ and CV vary. Rows: scenario $(\bar{\eta},\bar{\beta})$ . Shaded band: $P\geq 0.8$ .

Figure 3: $P(\mathrm{ROI}>0)$ as the daily alert volume $N$ (log scale) varies, per archetype. $\bar{\theta}{=}10\%$ , $\bar{\eta}{=}0.75$ , $\bar{\beta}{=}0$ , CV ${=}5\%$ . Dashed line: baseline $\bar{N}{=}1000$ .

Figure 4: Example cost with LLM $C^{m}$ as % of the no-LLM baseline $C^{\mathrm{noLLM}}$ . $\bar{\theta}{=}10\%$ , $\bar{\beta}{=}\bar{\eta}$ , CV ${=}5\%$ , $\bar{N}{=}1000$ . Whiskers: 10–90 percentile.

Figure 5: Downside risk of adoption $\mathrm{VaR}_{10\%}(\mathrm{ROI})$ (worst-decile loss), as $\theta$ and CV vary. Rows: mode $(\bar{\eta},\bar{\beta})$ . Col.: archetypes $(\bar{E}^{m})$ .

Figure 6: Profit region in the $(\bar{E}^{m},\bar{\eta})$ plane; $C^{m}_{\text{tech}}=0$ , $\mathrm{CV}=5\%$ , $\bar{\theta}=10\%$ . Dash-dot lines: archetypes, coded by deployment (A: API, S: self-hosted) and accuracy tier (H/M/L).

Figure 7: ROI sensitivity analysis per archetype, as deviation from the baseline operating point ( $\bar{\eta}=\bar{\beta}=0.75$ , $\bar{\theta}=10\%$ , $\bar{N}=1000$ ); shared normalized scale, $0$ = baseline; green above baseline, red below.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Model	Provider	Deploy Mode	$\boldsymbol{\gamma^{m,\text{in}}}$	$\boldsymbol{\gamma^{m,\text{out}}}$	$\boldsymbol{\delta^{m}_{\text{tot}}}$	$\boldsymbol{\delta^{m}_{\text{act}}}$	$\boldsymbol{E^{m}}$	Ref.
Hunyuan-Turbo	Tencent	API	$0.33	$1.33	–	–	94%	[ 79 ]
gpt-4.1	OpenAI	API	$2.00	$8.00	–	–	93%	[ 82 ]
gpt-4-turbo	OpenAI	API	$10.00	$30.00	–	–	92%	[ 81 ]
Grok-3	xAI	API	$3.00	$15.00	–	–	92%	[ 82 ]
DeepSeek-V3	DeepSeek	API	$0.27	$1.10	–	–	91%	[ 79 , 82 ]
o1-mini	OpenAI	API	$1.10	$4.40	–	–	91%	[ 79 ]

Appendix

Table 9: LLM pricing, size and cybersecurity benchmark accuracy. 71 distinct models (73 rows): DeepSeek-V3 and DeepSeek-R1 evaluated under both API and self-hosted deployment.

Organizational AI Adoption

See all 18 papers

From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness
Aug 1, 2026Jonas Thurner, Nadine Jost, Stefan Albert Horstmann +4Cybersecurity LLMs for Cybersecurity
FH Münster, Germany · Ruhr University Bochum, Germany · University of Cologne, Germany +2
Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit
Apr 11, 2026Souradip Nath, Chih-Yi Huang, Aditi Ganapathi +3LLMs for Cybersecurity Cybersecurity
Arizona State University · Technische Universität Berlin
Are Large Language Models Economically Viable for Industry Deployment?
Apr 21, 2026Abdullah Mohammad, Sushant Kumar Ray, Pushkar Arora +5LLM Inference Efficiency LLM Evaluation
DSEU-Okhla, New Delhi, India · University of Delhi, New Delhi, India · 6, 8Macquarie University, Sydney, Australia +1

Aug 1, 2026J/K move · Enter open · S save

From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness

Jonas Thurner, Nadine Jost, Stefan Albert Horstmann, Fabian Ising+3

FH Münster, Germany · Ruhr University Bochum, Germany · University of Cologne, Germany+2

Cybersecurity LLMs for Cybersecurity

Open paper AskPDF arXiv

Security Operations Centers (SOCs) process large volumes of security events, requiring analysts to accurately detect and assess ongoing cyberattacks under time pressure. Recent advances in Large Language Models (LLMs) suggest potential benefits for security operations, yet their practical suitability for real-world SOC workflows remains poorly understood. To address this gap, we conducted 25 semi-structured interviews with SOC practitioners who had prior experience with LLMs, complemented by interactive scenarios to anticipate challenges and identify opportunities for the responsible integration of LLM-based tools into SOC workflows. We identified 15 LLM use cases grouped into six functional categories. While LLMs are valued for automating repetitive, low-level tasks such as report automation, practitioners rate high-impact tasks such as incident analysis as not yet feasible, reporting limitations in technical depth, context awareness, and organization-specific knowledge. They locate these limitations less in the models than in the readiness of their SOCs and human factors driving over-reliance. Despite concerns, practitioners express a strong willingness to adopt LLMs, describing competitive pressure that leaves few alternatives. This work contributes an empirical, practitioner-driven analysis of LLM use across SOC roles and organizations and derives concrete design and integration requirements for human-centered, operationally safe LLM-assisted security operations.

Abstract

Organizational AI Adoption

Explore similar work

From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness

Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit

Are Large Language Models Economically Viable for Industry Deployment?