Vulnerability-Management

This is Part 2 in a two-part series. Read Part 1: Bridging the Cognitive Gap Introduction LLMs don’t reason. They don’t intuit. They don’t understand risk or strategy. But they are changing how work gets done — fast. From summarizing alerts, drafting recon reports, or reverse engineering malware with tools like GhidraMCP, these agents are delivering value in surprising places. Connected Workflows: Beyond Single-Tool Interaction The most promising developments come from connecting these tools into seamless workflows. Projects like NERVEdemonstrate the power of LLM-coordinated security tools, where a natural language request triggers multiple tools in sequence without requiring manual intervention at each step. ...

Large language models (LLMs) are rapidly becoming integrated into cybersecurity workflows, with systems now able to execute reconnaissance, analyze configurations, or detect potential vulnerabilities with increasing competence. Recent models such as OpenAI’s o1 and Google’s Gemini 2.5 have introduced internal deliberation loops, longer context management, and structured reasoning prompts to expand what models can handle. But something still feels incomplete. Security expertise lives in the gray areas: when to follow a hunch, what a naming convention might imply about infrastructure design, when a redirect chain is just odd enough to be worth digging into. We try to codify these things — through system prompts, retrieval systems, or agent workflows — but what we’re really doing is projecting structure onto a system that lacks true comprehension. ...

In the rapidly evolving landscape of AI-driven cybersecurity, an interesting truth emerges: as automation capabilities increase, the value of human judgment becomes not diminished but amplified. This third installment of our series explores why the “human-in-the-loop” approach remains indispensable despite remarkable advances in AI technologies. The Fundamental Limitations of Current Agentic AI Systems The current generation of AI-driven security tools, particularly agentic systems that attempt to autonomously plan and execute tasks, face significant challenges in security contexts where precision and reliability are non-negotiable. ...

In our previous exploration of cybersecurity’s AI-driven evolution, we examined how automation is reshaping our field and giving rise to a new type of professional—the hacker-strategist. Now I want to delve deeper into perhaps the most critical skill this hybrid role demands: prompt engineering. The Strategic Dimension of Prompt Engineering Prompt engineering in cybersecurity transcends the technical mechanics of crafting effective AI queries. It represents a fundamental shift in how security expertise is applied. As routine analyses become increasingly automated, the most valuable security professionals will be those who can leverage AI capabilities effectively—knowing when to use one-shot prompts, when to build multi-step workflows, and when to deploy more complex agentic solutions—all while maintaining the creative, boundary-testing mindset that has always characterized our field. ...

I’ve come to recognize two distinct mindsets in security: those grounded in technical reality, and those I call the “boogeyman crew.” The latter operates on fear rather than facts, treating every scanner-flagged “CRITICAL!” finding as an equally urgent disaster. Their world is populated by various specters: the compliance boogeyman who’ll condemn them for not addressing every high-severity CVE regardless of context, the dreaded auditor who’ll condemn them for not following frameworks to the letter and, of course, the truly bad actors lying in wait. ...