Every day brings a fresh wave of security vulnerabilities. AI has lowered the barriers to finding and disclosing them. That's good for security overall. But it also means the volume of disclosures keeps climbing.
For a hosting platform like Skpr, that noise is a real challenge. More disclosures mean more to sift through. Most of it won't affect us. The hard part is finding the few that do.
Fighting fire with fire
So we asked a simple question. What if we used AI to help us keep up with AI?
The idea was straightforward. Feed a model a list of new vulnerabilities, our platform's composition, and our security workflows. Then have it produce a daily summary for a human to triage.
That's exactly what we did, and what became our AI-powered vulnerability triage assistant.
What we built
We built a small AI tool that triages vulnerabilities every day. Yes, we're using AI to manage the flood of vulnerabilities that AI is helping to create. The irony isn't lost on us.
Each morning we get a notice in Slack. It outlines an initial list of what we should look into first.
The tool cuts through the noise. It surfaces the high-value vulnerabilities that deserve our attention. That saves our team time and sharpens our focus.
How it works
The tool runs as a serverless pipeline on Amazon Web Services (AWS). There are no servers for us to manage, and it only runs when scheduled. Here's the flow from trigger to triage:
Each step is simple:
- Scheduled trigger: Amazon CloudWatch starts the process on a daily schedule.
- Gather the data: An AWS Lambda function pulls the latest Common Vulnerabilities and Exposures (CVE) data from our sources.
- Refine and summarise: Lambda sends those vulnerabilities to Amazon Bedrock, along with our platform composition and security workflows. Bedrock returns a refined, summarised report.
- Report to Slack: Lambda posts the summary to a Slack channel for the team.
- Human triage: An engineer reviews the list and decides what to act on.
The whole run is quick and cheap. It only spins up when there's work to do.
Humans still make the call
This does not replace human triage. It never will.
The tool gives us a starting point, not a verdict. A senior engineer reviews the list and decides what matters. AI does the sorting. People do the judging.
We've found it to be a genuinely useful assistant. But it's an assistant, nothing more.
It complements what we already do
The tool sits alongside our existing vulnerability management. It doesn't replace any of it. We still run:
- Upstream project monitoring: we track our dependencies for known issues.
- Downstream platform monitoring: we watch what's actually running on our clusters.
Together, these give us coverage from the code we rely on to the systems we operate.
What's next
We're not done here. We'll keep improving the tool. A couple of things we're working on:
- Ticketing integration: we're evaluating whether identified vulnerabilities should be automatically logged as tickets.
- More data sources: today, we pull CVE data from the GitHub CVE Project list. We plan to add sources like the GitHub Advisory Database for more timely updates as issues are found.
The takeaway
AI is changing the security landscape on both sides. It helps researchers and attackers find more issues, faster. So it makes sense to put it to work on our side too.
For us, that means less noise and sharper focus. We spend more time on the vulnerabilities that count, with our team firmly in control.