Invisible Intelligence: Integrating LLMs Directly into ESET Security Workflows

Large Language Models are often presented as chatbots, but at ESET we believe their real value lies in strengthening protection, not adding another interface. In this session, we will show how ESET integrates LLMs directly into products and detection pipelines to help customers move faster from inspection to action, while preserving trust, transparency, and performance. The talk reintroduces ESET AI Advisor, built on an agentic architecture where multiple domain specific agents, including incident analysis, threat intelligence, knowledge base, help systems, and internal tools, collaborate with each other. These agents use APIs, tools, and retrieval augmented generation (RAG) to deliver intelligence directly within the product experience, rather than through a standalone chatbot. Instead of asking users to write prompts, AI is embedded into the UX itself through automatically generated incident titles, concise summaries, and clear recommended actions. We also cover the production foundations behind this system, including evaluation and quality frameworks, the continued role of a human expert layer, and why high quality curated data remains essential for reliable AI. In the second part, we share lessons learned from on premise malware triage of script based artifacts, such as PowerShell and JavaScript, which are frequently abused by attackers. In this area, classical machine learning approaches proved insufficient, leading us to explore LLM based classification. These experiments highlighted practical challenges, including performance constraints, handling obfuscation, anonymization requirements, cost control, and effective deduplication. We explain how these insights influenced ESET’s strategy for using LLMs in on premise and hybrid environments, with a strong focus on reliability, efficiency, and customer trust.

Filip Mazan Bio

Filip Mazán is the senior manager of Advanced Threat Detection & AI Research at ESET, where he leads teams focused on leveraging artificial intelligence and machine learning for automated threat detection and cyberthreat hunting. Since joining ESET in 2013 as a malware analyst, Filip has advanced into a software engineering role and now oversees research projects utilizing deep learning and GenAI to enhance global cybersecurity efforts. His expertise includes dismantling major botnets like Dorkbot and Gamarue and speaking at industry-leading events, such as the RSA Conference. Beyond his professional achievements, Filip enjoys cooking, gardening, and exploring home automation technologies.

Jozef Duc Bio
Jozef joined ESET in 2018 and is a core member of the Automated Detection and Intelligence team, specializing in automated malware detection, machine learning–driven systems, and large-scale backend pipelines for real-time threat identification. He has played a key role in designing and building several of ESET’s core detection systems, turning complex threat intelligence into reliable, production-grade automation at scale. His work has supported botnet disruption efforts targeting LummaStealer, Emotet, and Trickbot, as well as the identification of malicious UEFI threats in the wild. He generally prefers building complex detection systems to speaking about them - but occasionally makes an exception.

Masterclass Technical deep-dive

More presentations from Filip Mazan: BS AI&FTT 1 / The Shock of AI Impact and How to Absorb It