INTRODUCTION Cybersecurity is crucial for organizations to contain and reduce cyber threats. However, modern teams are OVERWHELMED BY A HIGH VOLUME AND COMPLEXITY OF SECURITY ALERTS , which can lead to analyst fatigue, slower response times, and missed threats . On average, enterprise security teams analyze hundreds of thousands of events each day, leading to tens of thousands of hours wasted on false positives . This data overload exceeds human capacity, causing delays in responses and unresolved incidents . Compounding the challenge is the CYBERSECURITY TALENT SHORTAGE. Industry studies predict that by 2025, a lack of skilled analysts (or human error due to overload) will account for over half of major security incidents . Meanwhile, attackers are employing advanced tactics; for example, threat actors are now leveraging generative to craft large-scale, convincing phishing campaigns . These trends emphasize the urgent need to IMPROVE AND AUTOMATE the incident response process. In this context, () and ) techniques offer promising solutions for IR automation. Many security workflows involve unstructured text data – from log messages and alerts to threat intelligence reports and incident tickets. Indeed, a large portion of cybersecurity information is encoded in textual or semi-structured form, making an invaluable tool for parsing and understanding security events . The rise of transformer-based language models has greatly enhanced capabilities in recent years. Transformers, such as and , possess a deep understanding of language, enabling them to perform tasks like classification, summarization, and anomaly detection on security-related texts. Previous research suggests that employing ( and transformers on cyber data can significantly enhance threat detection and incident analysis . For instance, IBM’s Watson for Cyber Security was trained on over one million security documents, assisting analysts in interpreting threat reports that were often inaccessible to traditional tools . Initial deployments indicated that cognitive technologies could reduce investigation times from weeks or days to just minutes by automating the correlation of threat intelligence with incident data . , an open-source library from Hugging Face, provides a gateway to the operationalization of such advanced models in practice. Hugging Face has built a vibrant platform with over 350,000 pre-trained models and 75,000 datasets, enabling practitioners to share and utilize state-of-the-art models . Within the Hugging Face ecosystem, the _Transformers_ library focuses on text and sequence tasks. In contrast, the _Diffusers_ library specializes in TRANSFORMER-BASED DIFFUSION MODELS for generative tasks . Diffusers simplify the development and inference of diffusion models (commonly used for generating images from text ). Although primarily geared towards generative , leverages the same underlying transformer architecture that has revolutionized . In this paper, we adapt and fine-tune transformer models accessible through Hugging Face for cybersecurity incident response automation. We justify the use of (and related tools) due to their ease of use, access to pre-trained models, and strong community support, which together lower the barrier to applying cutting-edge in the security domain. Our goal is to demonstrate that transformer-based automation can transform incident response, reducing mean time to respond, improving detection accuracy, and enabling analysts to focus on complex decision-making rather than repetitive tasks. We organized the remainder of this paper as follows. - (SECTION 1) : Provides background on incident response processes and the motivation for automation. - (SECTION 2) : Offers an overview of Hugging Face Diffusers and explains why this framework is suitable for IR tasks. - (SECTION 3) : Reviews related work, including applications of NLP in cybersecurity, the use of transformers in threat detection, and real-world case studies of AI-driven IR. - (SECTION 4) : Provides background on incident response processes and the motivation for automation. - (SECTION 5) : Presents a case study that applies our approach to a phishing incident scenario, providing results with actual data and a performance evaluation. - (SECTION 6) Discusses the impact of such automation on IR effectiveness, its current limitations, and the associated ethical considerations. - (SECTION 7) Outlines future directions, including enhancing transformer-based solutions, incorporating multi-modal data, and expanding AI’s role in cybersecurity in a responsible manner. We conclude in - (SECTION 8) With a summary of findings and a call to action for adopting AI-driven incident response. Finally, - (SECTION 9) Acknowledges the collaborative and research support that enabled this work.