The cybersecurity landscape is in constant flux, inundating security professionals with an overwhelming and ever-growing data stream. Hidden within this torrent are critical insights ranging from textual indicators on social media and technical reports to discussions on dark web forums, which, if properly harnessed, can offer a strategic edge. Cyber Threat Intelligence (CTI) has traditionally relied heavily on manual analysis or rudimentary keyword-based methods, resulting in significant inefficiencies, delayed responses, and missed threat signals. Today, security analysts are challenged not only by the sheer volume of data but also by increasingly sophisticated adversarial techniques such as code obfuscation, misinformation campaigns, and advanced social engineering. The rapid pace of threat evolution demands not just faster but smarter ways to extract intelligence and respond effectively. This is where Natural Language Processing (NLP) and, in particular, Large Language Models (LLMs), are proving revolutionary approaches and results. LLMs represent a paradigm shift in how we process and understand unstructured text data. With their unparalleled ability to comprehend context, generate insights, and reason over language, LLMs have become indispensable in the CTI pipeline. They enable scalable automation, accurate threat interpretation, and real-time intelligence extraction from diverse and complex textual sources. By leveraging the deep understanding and generative capabilities of LLMs, organizations can go beyond reactive defense mechanisms to develop proactive, anticipatory strategies that adapt to emerging threats with unprecedented speed and precision. Recent advances in agentic AI systems further extend these capabilities by enabling LLM-based agents to autonomously plan, coordinate tools, and perform multi-step CTI analysis workflows, opening new opportunities for proactive and adaptive cyber defense.

This workshop aims to spotlight the transformative potential of Artificial Intelligence, NLP, and especially LLMs in revolutionizing cybersecurity, focusing on their application in CTI gathering and analysis. It will provide a vibrant platform for researchers, practitioners, and enthusiasts to explore cutting-edge approaches, share breakthroughs, and foster collaboration in shaping the future of intelligent cyber defense.
We encourage original and high-quality contributions, preliminary work, and novel ideas on topics, including but not limited to:

- Information extraction in CTI
- Deep learning architectures for threat detection and analysis
- Visualization techniques for CTI
- LLMs for CTI
- CTI Sharing
- Hunting and Tracking Adversaries
- Explainable AI in Cybersecurity
- Dynamic Threat Adaptation with LLMs
- Multimodal Threat Intelligence Fusion
- LLMs for Malware Detection
- Federated Learning for Threat Detection
- LLMs for Social Media Threat Analysis
- LLMs and Visual Content
- Multimodal Large Language Models (MLLMs)
- Cross-lingual Threat Intelligence using LLMs
- Misinformation Detection in CTI with LLMs
- LLM-powered Threat Scenario Generation
- Human-in-the-loop systems for LLM-based CTI
- Explainable Threat Intelligence Reports with LLMs
- Benchmarking LLM Performance
- Zero Trust and CTI
- CTI in the IoT domain
- AI/GenAI for users’ behavior analysis and inference
- GenAI for mobility management and network control
- AI/GenAI within 6G networks
- Blockchain-based approaches for CTI
- Applying CTI/Case Studies
- CTI for IoT Systems
- Using IoT for sourcing CTI
- Web crawlers and scrapers for IoT threat information
- LLM-driven anomaly and fault detection in networks
- LLMs for Network Security and Privacy
- LLMs for detecting malware in network traffic
- QoS/QoE prediction and optimization using LLMs
- Federated learning with LLMs
- LLMs and Network Data Analytics
- Summarization of network incidents and logs via LLMs
- Ethical considerations, fairness, and bias in LLM-driven systems
- LLMs for cybersecurity education and training in networked environments
- Agentic AI systems for autonomous CTI analysis and adaptive cyber defense