Design and Implementation of an LLM-Assisted Incident Triage Framework for Cybersecurity Threat Mitigation in Resource-Constrained Enterprises

Small and Medium Enterprises (SMEs) in Nigeria generate more than 48% of the nation’s GDP and employ over 80% of the workforce, yet they do not have the resources to run Security Operations Centers or hire professional analysts. In this research, we discuss the design, implementation and empirical evaluation of a lightweight LLM-assisted incident triage platform tailored for resource-constrained contexts. The system is designed with a Python orchestration engine that ingests danger indicators (i.e. emails, URLs, and file hashes) and performs multi-layered analysis. DeepSeek Large Language Model contextual and linguistic analysis for social engineering detection. VirusTotal Signature based threat intelligence on URL reputation. Both signals are fused in an automatic triage verdict by a decision fusion module. The solution is deployed as a public Streamlit Cloud web application with source code available on GitHub. For LLM-only analysis, we achieved accuracy of 93.0%, precision of 94.6%, recall of 91.2%, and a false positive rate of 5.2% on 500 samples from the TREC subset of the MeAJOR corpus at an estimated cost of roughly ₦105 per analysis. Importantly, a controlled comparison on 126 URL-bearing samples revealed that the fusion with VirusTotal dropped the accuracy to 77.0%, because old URLs not present in current threat intelligence were routinely mis-scored as benign. This unfavourable conclusion is presented in full because of its practical significance for hybrid detection system design in low-resource contexts.