Search papers, labs, and topics across Lattice.
CyberCertBench, a new MCQA benchmark suite derived from cybersecurity certifications, is introduced to evaluate LLM domain knowledge against industry standards in IT, OT, and specialized cybersecurity areas. The study reveals that while frontier models achieve human expert level in general networking and IT security, their accuracy drops significantly in vendor-specific or formal standard-related questions. A novel Proposer-Verifier framework is also proposed to generate interpretable explanations for model performance.
LLMs can ace general cybersecurity, but choke on vendor-specific trivia and formal standards, revealing critical gaps in their real-world applicability.
The rapid evolution and use of Large Language Models (LLMs) in professional workflows require an evaluation of their domain-specific knowledge against industry standards. We introduceCyberCertBench, a new suite of Multiple Choice Question Answering (MCQA) benchmarks derived from industry recognized certifications. CyberCertBench evaluates LLM domain knowledgeagainst the professional standards of Information Technology cybersecurity and more specializedareas such as Operational Technology and related cybersecurity standards. Concurrently, we propose and validate a novel Proposer-Verifier framework, a methodology to generate interpretable,natural language explanations for model performance. Our evaluation shows that frontier modelsachieve human expert level in general networking and IT security knowledge. However, theiraccuracy declines in questions that require vendor-specific nuances or knowledge in formalstandards, like, e.g., IEC 62443. Analysis of model scaling trend and release date demonstratesremarkable gains in parameter efficiency, while recent larger models show diminishing returns.Code and evaluation scripts are available at: https://github.com/GKeppler/CyberCertBench.
