Can LLMs Hack Enterprise Networks? Autonomous Assumed Breach Penetration-Testing Active Directory Networks

Heuristic evaluation of user interfaces. In Proceedings of the SIGCHI conference on Human factors in computing systems . 249–256

Jakob Nielsen and Rolf Molich. 1990 · 1990

Earlier work this paper cites.

Preliminary guidelines for empirical research in software engineering

Barbara A Kitchenham, Shari Lawrence Pfleeger, Lesley M Pickard, Peter W Jones, David C. Hoaglin, Khaled El Emam, and Jarrett Rosenberg. 2002 · 2002

Earlier work this paper cites.

Mastering Active directory for Windows server 2003

Robert R King. 2006 · 2003

Earlier work this paper cites.

Using thematic analysis in psychology

Virginia Braun and Victoria Clarke. 2006 · 2006

Earlier work this paper cites.

Constructing grounded theory: A practical guide through qualitative analysis

Kathy Charmaz. 2006 · 2006

Earlier work this paper cites.

Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE symposium on security and privacy . IEEE, 305–316

Robin Sommer and Vern Paxson. 2010 · 2010

Earlier work this paper cites.

POMDPs make better hackers: Accounting for uncertainty in penetration testing. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 26. 1816–1824

Carlos Sarraute, Olivier Buffet, and Jörg Hoffmann. 2012 · 2012

Earlier work this paper cites.

Penetration testing== POMDP solving?

Original

Carlos Sarraute, Olivier Buffet, and Jörg Hoffmann. 2013 · 2013

Earlier work this paper cites.

Sociological methods: A sourcebook

Norman K Denzin. 2017 · 2017

Earlier work this paper cites.

Active Directory and Related Aspects of Security. In 2018 21st Saudi Computer Society National Computer Conference (NCC) . 4474–4479

Afnan Binduf, Hanan Othman Alamoudi, Hanan Balahmar, Shatha Alshamrani, Haifa Al-Omar, and Naya Nagy. 2018 · 2018

Earlier work this paper cites.

Zero trust architecture

V Stafford. 2020 · 2020

Earlier work this paper cites.

The rise of ransomware: Forensic analysis for windows based ransomware attacks

Ilker Kara and Murat Aydos. 2022 · 2021

Earlier work this paper cites.

Caldera: A red-blue cyber operations automation platform

Ron Alford, Dean Lawrence, and Michael Kouremetis. 2022 · 2022

Earlier work this paper cites.

Sample sizes for saturation in qualitative research: A systematic review of empirical tests

Monique Hennink and Bonnie N Kaiser. 2022 · 2022

Earlier work this paper cites.

The Rise of Ransomware: A Review of Attacks, Detection Techniques, and Future Challenges. In 2022 International Conference on Business Analytics for Technology and Security (ICBATS) . 1–7

Samar Kamil, Huda Sheikh Abdullah Siti Norul, Ahmad Firdaus, and Opeyemi Lateef Usman. 2022 · 2022

Earlier work this paper cites.

Large language models are zero-shot reasoners

Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022 · 2022

Earlier work this paper cites.

Comparing attack models for it systems: Lockheed martin’s cyber kill chain, mitre att&ck framework and diamond model. In 2022 IEEE International Symposium on Systems Engineering (ISSE) . IEEE, 1–7

Nitin Naik, Paul Jenkins, Paul Grace, and Jingping Song. 2022 · 2022

Earlier work this paper cites.

Chain-of-thought prompting elicits reasoning in large language models

Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al · 2022

Earlier work this paper cites.

Concepts and evaluation of saturation in qualitative research

Liping Yang, Lidong QI, and Bo Zhang. 2022 · 2022

Earlier work this paper cites.

React: Synergizing reasoning and acting in language models

Original

Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. 2022 · 2022

Earlier work this paper cites.

Automatic chain of thought prompting in large language models

Original

Zhuosheng Zhang, Aston Zhang, Mu Li, and Alex Smola. 2022 · 2022

Earlier work this paper cites.

Penheal: a two-stage llm framework for automated pentesting and optimal remediation. In Proceedings of the Workshop on Autonomous Cybersecurity . 11–22

Junjie Huang and Quanyan Zhu. 2023 · 2023

Cited alongside, same era.

SoK: The MITRE ATT&CK Framework in Research and Practice

Original

Shanto Roy, Emmanouil Panaousis, Cameron Noakes, Aron Laszka, Sakshyam Panda, and George Loukas. 2023 · 2023

Cited alongside, same era.

Plan-and-solve prompting: Improving zero-shot chain-of-thought reasoning by large language models

Original

Lei Wang, Wanyu Xu, Yihuai Lan, Zhiqiang Hu, Yunshi Lan, Roy Ka-Wei Lee, and Ee-Peng Lim. 2023 · 2023

Cited alongside, same era.

PentestGPT: An LLM-empowered Automatic Penetration Testing Tool

Original

Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. 2024 · 2024

Cited alongside, same era.

VulnBot: Autonomous Penetration Testing for A Multi-Agent Collaborative Framework

Original

He Kong, Die Hu, Jingguo Ge, Liangxiong Li, Tong Li, and Bingzhen Wu. 2025 · 2025

Closest in time.

Active Directory Holds the Keys to your Kingdom, but is it Secure?

Swetha Krishnamoorthi and Jarad Carleton. 2020 · 2025

Closest in time.

When Thinking Fails: The Pitfalls of Reasoning for Instruction-Following in LLMs

Original

Xiaomin Li, Zhou Yu, Zhiwei Zhang, Xupeng Chen, Ziji Zhang, Yingying Zhuang, Narayanan Sadagopan, and Anurag Beniwal. 2025 · 2025

Closest in time.

LLM Cyber Evaluations Don’t Capture Real-World Risk

Original

Kamilė Lukošiūtė and Adam Swanda. 2025 · 2025

Closest in time.

Global Ransomware Damage Costs Predicted To Exceed $275 Billion By 2031

Steve Morgan. 2025 · 2025