Abstract
Introduction This study examines the role of generative artificial intelligence (GenAI) in cybersecurity threat detection, focusing on its usefulness in workflows that support human decision-making. Methods Experiments were performed on the BODMAS dataset (134,435 samples) and a smaller exploratory subset of UNSW-NB15. State-of-the-art machine learning (ML) classifiers were compared with a zero-shot large language model (LLM) using standard classification metrics, while also considering latency, cost, and hallucination risk. Results ML classifiers consistently outperformed the LLM-based system on standard detection metrics. However, the LLM showed value in cases of ambiguity, where it could provide short plain-language explanations, organize alert-related context, and generate initial interpretations for instances that did not match learned classes. Discussion GenAI is unlikely to replace ML-based detection methods, but it can provide useful interpretive support for ambiguous or unfamiliar alerts. A hybrid pipeline is therefore proposed, in which ML handles high-confidence and time-sensitive decisions, while the LLM is used selectively for low-confidence cases or when explanatory support is needed. Human oversight remains necessary to address hallucination risk and ensure reliability.