I am being asked to incorporate more and more GenAI into my workflow at work. One of these workflows was using an LLM to go through our vulnerability system of record and tease out “easy wins” for us to fix. I am conflicted on doing this as:
I don’t know how much this will actually increase security.
Feeding my vuln data into an LLM seems like a bad idea
I personally don’t have time to do this myself
No one on my team can really take this task on in the near future
It is seeming at my job it is “Use AI or be replaced by AI” and this is all I can think of
What are the experts thoughts here on this very narrow use of GenAI?
What AI? If it’s a model you have a BAA with or a ZDR agreement, the risk is different than a consumer offering.
What will the output look like and how is it different from what’s in the vuln DB?
If no one can take the task, how is it getting done?
I would broadly say that this seems like makework that at best is pointless and at worst will create additional overhead for asset owners.
My direct suggestion is to build a thing that queries the existing vuln DB, does some light triage based on risk scores, and produces a priority list for a given owner. That way you’re not making stuff up, and maybe that list format will be easier to digest (it won’t matter, but at least you’re causing minimal harm).
For which AI we are still working out which models we can use with this data and how to get the data out of the application. The output is supposed to crunch the data and summarize the tens of thousands of medium and lower vulnerabilities into a few actionable steps. And three, this task just isn’t getting done as without the “AI easy button” its deem not worth the time to chase medium and lower issues.
Some of my answers might sound a bit harsh, if not outright rude. This is very much not my intention, I merely want to avoid misunderstandings through sugarcoating.
Chances are that it won’t - at least not by itself. Let’s assume that the solution you come up with actually does spew out some “easy wins” (although it’s worth pointing out that your definition of “easy win” might significantly differ from what an LLM considers an “easy win”). In that case those “easy wins” still need to be done, applied, remedied .. and it sounds like you’re not exactly blessed with an abundance of resources.
If it’s something you host yourself, that’s generally not an issue. If you are being asked to feed sensitive internal data into a “commercial” provider like Claude, ChatGPT and so on - oh boy, that’s a can of worms that you should only open with your legal department involved as closely as possible.
That is not your issue, that is not your decision. Communicate the resource situation to your superiors (or whichever party is relevant here). If they want the job done they need to allocate resources or let you know, in writing, what other task you need to drop.
See 3.
It’s a horse that’s been ridden to death, brought back to life, then ridden to death again, but the old mantra of “Accept it, change it, leave it” applies here. If you can live with this new direction your employer is taking, just roll with it. If not, try to push back and change things so you can live with it. If you can’t it’s time to dust off your CV and seek employment elsewhere - you would definitely not be alone. I have spoken to friends in the industry who are changing employer because of AI-policies and I’ve heard it from applicants in interviews as well.
Does it have to be “vulns”? Or can you used like Bedrock to review system configurations? Yes, that’s totally what what your SMEs and vendor TAMs should already be doing, and best practices are generally documented (thus scraped), but I think it will more reliably identify those quick wins.
We have Azure CLI enabled Our GPO could be tuned here Why is Bluetooth enabled on some WAPs?
And this is kind of related to vulns. I find a lot of easy posture/exploitability wins in just turning stuff off that’s unnecessary.
Attack surface isn’t just IPs and assets, but the services and functions they run. Reducing that is measurable and awesome. Maybe AI can be “the neck that turns the head” for addressing long-standing risk registry items.
