Anvesh Vishwaraju (@anveshv)

Why Single-Layer LLM Triage Is Dangerous in a SOC — And the Architecture I'm Building to Prevent It

Published on Hashnode | Anvesh Raju Vishwaraju | June 2026 I came across an article recently that genuinely surprised me. Not because the topic was new to me — but because someone at the same educatio

10 min readanveshtheaisocanalyst.hashnode.dev

1Jun 3

Why LLMs Hallucinate on MITRE ATT&CK — And How RAG Fixes It

The Problem Ask any frontier LLM "what sub-techniques fall under T1078 — Valid Accounts?" and you'll get a confident, detailed answer. You'll also get things that are wrong. Not because the model is u

4 min readanveshtheaisocanalyst.hashnode.dev

May 22

Bridging the Detection-Exploitation Gap with AI: Building PentestX

PentestX is an AI-augmented security toolkit I built during my final semester at UNC Charlotte — it combines offensive penetration testing with defensive SOC triage in a single modular CLI framework.

4 min readanveshtheaisocanalyst.hashnode.dev

May 22

Anvesh Vishwaraju

About

Available for

Anvesh Vishwaraju's blogs

Why Single-Layer LLM Triage Is Dangerous in a SOC — And the Architecture I'm Building to Prevent It

Why LLMs Hallucinate on MITRE ATT&CK — And How RAG Fixes It

Bridging the Detection-Exploitation Gap with AI: Building PentestX

Anvesh Vishwaraju

About

Available for

Anvesh Vishwaraju's blogs

Why Single-Layer LLM Triage Is Dangerous in a SOC — And the Architecture I'm Building to Prevent It

Why LLMs Hallucinate on MITRE ATT&CK — And How RAG Fixes It

Bridging the Detection-Exploitation Gap with AI: Building PentestX

Anvesh Vishwaraju

About

Available for

Anvesh Vishwaraju's blogs

Why Single-Layer LLM Triage Is Dangerous in a SOC — And the Architecture I'm Building to Prevent It

Why LLMs Hallucinate on MITRE ATT&CK — And How RAG Fixes It

Bridging the Detection-Exploitation Gap with AI: Building PentestX

Search Hashnode

Anvesh Vishwaraju

About

Available for

Anvesh Vishwaraju's blogs

Why Single-Layer LLM Triage Is Dangerous in a SOC — And the Architecture I'm Building to Prevent It

Why LLMs Hallucinate on MITRE ATT&CK — And How RAG Fixes It

Bridging the Detection-Exploitation Gap with AI: Building PentestX