Speeding Up Vulnerability Triage: Automating Context Retrieval with AI Agents
summary
Claim: triage is a context-aggregation problem, not detection. A single LM agent that pastes every data dump overruns the context window and hallucinates, so an orchestrator with specialized sub-agents is built instead (using LangGraph-style react loops). Each sub-agent keeps its own context, returns synthesized evidence, and the system stores full reasoning trace and tool outputs for audit. Real outcomes: from ten flagged container images only five are deployed, two are prod and one is internet-facing, so one immediate remediation replaces ten hours of manual work. Costs are high but tractable.
AI-written summary · about
chapters (15)
- 0:00AI in vulnerability management
- 1:06Vulnerability triage problems
- 7:47AI agents overview
- 12:01Single agent attempt
- 19:29Orchestrator architecture
- 26:04Subdomain takeover example
- 30:38CVE in container images
- 36:37Key lessons and future work
- 41:13Q&A: Token costs and scalability
- 42:36Q&A: Orchestrator frameworks
- 43:38Q&A: Accuracy and hallucinations
- 45:04Q&A: Self-improvement mechanics
- 46:50Q&A: Human feedback learning
- 47:10Q&A: Orchestrator guidance
- 48:36Q&A: Memory management
related talks
16mAI Agents for Incident Investigation: The Good, The Bad, and The Ugly
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage- 43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
30mAI Agents for Incident Management
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
42mAI for security - friend or foe?
15mClearAgent: Agentic Binary Analysis for Effective Vulnerability Detection
27mThe AI Velocity Trap: Shipping Faster Without Breaking More