In 2025, Luigi Coppolino et al published a study showing how large language models (LLMs) can improve the discovery of assets in critical infrastructures. Traditional tools such as Nmap or industrial security platforms either risk disrupting sensitive systems through active scans or fail to detect hidden devices when relying only on passive monitoring.

The researchers proposed an LLM-based “Mixture of Experts” framework that combines data from passive traffic observation, carefully limited active probing and physical signals such as electromagnetic emissions. Specialised LLM agents then interpret this data: one focuses on industrial protocols, another on vulnerabilities in IT/OT networks, and another on system architecture and dependencies.

The system can also draw on external intelligence sources (such as MITRE ATT&CK or CVE databases) to identify weaknesses and recommend security measures. In tests on a simulated industrial network, it successfully classified assets like programmable logic controllers, robotic arms, and printers, while flagging insecure practices such as unencrypted Modbus traffic.

Such an approach turns attack surface mapping into an adaptive and context-aware process that provides real-time visibility and reduces the risks of traditional scanning. By lowering the technical barriers for defenders, it enables more comprehensive monitoring and strengthens the overall security posture of critical infrastructure.