From Idea to Open-Source: Building CNA-GURU, a Generative AI Assistant for Security Advisories
summary
An open-source assistant called CNA‑GURU evolves from a prototype into three portable deployments (full Bedrock-backed service, cost‑reduced local RAG “Jr.”, and a Jupyter “Esquire” notebook) that use Amazon Bedrock, Streamlit and ECS/Fargate to parse descriptions, propose three CWEs, and draft advisories. Evaluation on 300 random NVD entries shows 90% accuracy on CWE matches and CVSS within 0.2, and the tool cuts triage time from ~3 hours to minutes.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:05Why we built CNA-GURU
- 3:11Initial infrastructure
- 5:41Key features demo
- 7:29Follow-up questions improve training
- 10:21Evaluating accuracy
- 12:43Testing methodology
- 14:31Cost-efficient versions
- 16:17Deployment with Jupyter
- 17:18Use cases demo
- 19:48Common use cases
- 22:59Why open-source
- 24:05Conclusion
- 25:36Q&A
related talks
51mAutomating CNA CVE Reporting and Monthly Bulletins
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
26mImproving Cybersecurity Posture with an AI Security Assistant
26mCyRAG: Retrieval Augmented Generation for Robust Cyber Defense
50mThe ART of Probable: Test with AI, Atomic Red Team, and Threat Metrics
17mElevating security investigations with generative AI
25mOpen Source Projects and AI Security
25mCSAF 2.0 - A New Start to Automate Advisories