Large language models are now both a target and a tool in cybersecurity. This project studies both sides with open-weight models that we run ourselves on NAISS infrastructure. On the defensive side, we build LLM-driven honeypots, decoy systems that use an LLM to respond convincingly to attackers and collect threat intelligence. CowrieMind evaluates LLM-backed SSH honeypots for realism, state consistency and deployment cost. PromptSSH asks whether prompt design or model size drives honeypot quality. ICSnare, a new study, extends LLM-driven deception to industrial control systems, where realistic decoys are scarce and attacker data is especially valuable for Swedish critical infrastructure. On the offensive side, we measure how LLM guardrails fail in agentic deployments, for example lateral movement after a guardrail leak, and how LLMs perform at software vulnerability discovery. The project supports a PI-led lab of around ten MSc thesis students a year and is funded by Digital Futures (CORTEX, 2026-2027). Running open-weight models locally rather than through commercial APIs makes the experiments reproducible and keeps attacker data under Swedish control.