Search papers, labs, and topics across Lattice.
CritBench is introduced as a new evaluation framework for assessing LLM cybersecurity capabilities within IEC 61850 digital substation environments, an Operational Technology (OT) domain. The framework tests LLMs on 81 domain-specific tasks, including static analysis, network reconnaissance, and live VM interaction, using a custom tool scaffold for industrial protocol interaction. Results show that while LLMs perform well on static analysis and single-tool network tasks, they struggle with dynamic tasks requiring persistent reasoning and state tracking, a limitation mitigated by the provided tool scaffold.
LLMs know the lingo of industrial control systems, but can't yet reliably hack them without specialized tools.
The advancement of Large Language Models (LLMs) has raised concerns regarding their dual-use potential in cybersecurity. Existing evaluation frameworks overwhelmingly focus on Information Technology (IT) environments, failing to capture the constraints, and specialized protocols of Operational Technology (OT). To address this gap, we introduce CritBench, a novel framework designed to evaluate the cybersecurity capabilities of LLM agents within IEC 61850 Digital Substation environments. We assess five state-of-the-art models, including OpenAI's GPT-5 suite and open-weight models, across a corpus of 81 domain-specific tasks spanning static configuration analysis, network traffic reconnaissance, and live virtual machine interaction. To facilitate industrial protocol interaction, we develop a domain-specific tool scaffold. Our empirical results show that agents reliably execute static structured-file analysis and single-tool network enumeration, but their performance degrades on dynamic tasks. Despite demonstrating explicit, internalized knowledge of the IEC 61850 standards terminology, current models struggle with the persistent sequential reasoning and state tracking required to manipulate live systems without specialized tools. Equipping agents with our domain-specific tool scaffold significantly mitigates this operational bottleneck. Code and evaluation scripts are available at: https://github.com/GKeppler/CritBench
