The LLM tax is the extra cost, latency, and operational overhead created when a language model is used for work that could be handled more simply by rules, schemas, or deterministic code. In security systems, this often happens when an agent or workflow sends routine tasks such as routing, formatting, validation, or simple classification through the model instead of a fixed decision path.
It matters in cyber security because repeated model calls can turn a useful defense into an expensive and fragile one. In a SOC, for example, an LLM may help summarize alerts or analyze unstructured text, but using it for every predictable step can increase spend, slow response, and add variability. Attackers may also try to exploit this by flooding a system with inputs that trigger unnecessary model usage, creating a cost or availability pressure. Good defenses reduce the LLM tax by reserving model calls for ambiguous problems and keeping routine logic in code.