CVE triage: an AI workflow for vulnerability prioritisation
The scanner flags CVE-2024-3400, a command injection in Palo Alto PAN-OS GlobalProtect rated CVSS 10.0, on two firewalls. One is internet-facing and the flaw is being exploited. The same report lists dozens of medium findings on internal systems. The question is which ones break the patch window.
This workflow reads the advisory with a cheap model, then checks your asset inventory and searches for exploit reports at the same time. A router sends exploited, KEV-listed or exposed flaws to a stronger model that writes an emergency change, which waits for approval. Everything else becomes a short ticket for the monthly window.
Free in Sim. No account or API key.
Sample input
CVE-2024-3400: PAN-OS GlobalProtect command injection, CVSS 10.0. Our scanner flags two firewalls. One is internet-facing. Exploited in the wild. Patch now or wait for Saturday's window?
How the workflow runs, step by step
1. Start
Advisory in
The advisory or scanner finding starts the run, beginning with the CVE id.
Next: Read advisory
2. Agent
Read advisory
A small model pulls the CVE id, product, CVSS score, exploit status and fix, without guessing versions.
Next: Asset inventory, Exploit status
3. Tool
Asset inventory
Searches your asset inventory and patch policy for affected hosts and their exposure. It stands in for your CMDB or scanner export.
Next: Evidence
4. Tool
Exploit status
Searches the web for the CVE id to find public exploit reports.
Next: Evidence
5. Join
Evidence
Waits for the inventory and the search and passes both on.
Next: Priority
6. Router
Priority
Keyword rules send internal, unexploited flaws to the patch cycle. Exploited, KEV-listed or internet-facing flaws go to an emergency change, which is also the default.
Next: Emergency change (emergency), Patch-cycle ticket (patch cycle)
7. Agent
Emergency change
A stronger model writes the emergency change: affected hosts, the fix, a mitigation if the patch must wait, what to hunt for in logs, how to verify and how to roll back.
Next: Change approve
8. Human approval
Change approve
The run pauses. The change owner approves before anyone patches outside the window.
Next: Emergency ticket
9. Result
Emergency ticket
The approved emergency change.
10. Agent
Patch-cycle ticket
For routine flaws, a cheap model writes a short ticket for the next patch window and when to raise it.
Next: Backlog ticket
11. Result
Backlog ticket
The ticket for the next patch window.
Why build it as a graph
Scanners produce far more findings than any team can patch at once, and most of them can wait. A graph keeps the cheap read and the lookups on every finding, saves the strong model for the few that need an emergency change, and puts change approval in the workflow where it can be seen.
Things to try
- Run the sample in Sim. It takes the emergency path and waits for change approval.
- Try “Medium flaw in our internal wiki, CVSS 5.4. Internal only, no known exploit.” It becomes a cheap patch-cycle ticket.
- Switch to Live with your own key so real models read the inventory and the search results. The strong model still only runs on the emergency step.