Skip to content

AI Analysis

AI is used in two places in BreachSpider: it enriches CVE records with ICS/OT analysis, and it runs a chat assistant that retrieves from BreachSpider's own vulnerability data (retrieval-augmented generation) rather than answering from general knowledge. Vulnerability matching and ranking are deterministic and do not use AI.

The AI assistant is not a general-purpose chatbot. It does not answer questions about cooking, travel, or general knowledge. It is scoped to ICS/OT vulnerability context, industrial protocols, compliance frameworks, and control system remediation strategies.

What the AI Analysis Covers

The AI analysis draws on context about:

  • PLC programming and patching: Why patching a PLC is different from patching a Windows server. Why firmware updates require maintenance windows, vendor coordination, and process shutdown planning.
  • NERC CIP requirements: What CIP-007, CIP-010, and CIP-013 require for documented patch management, configuration monitoring, and supply chain risk management.
  • Industrial protocols: How Modbus, DNP3, OPC-UA, EtherNet/IP, PROFINET, and BACnet are affected by different CVE classes. What protocol-level mitigations are available.
  • OT vs IT context: The difference between a buffer overflow in a web browser (IT concern) and a buffer overflow in a PLC communication stack (operational safety concern).
  • Compensating controls: What controls are realistic for OT environments where patching is not immediately feasible. Network segmentation, protocol filtering, application whitelisting, enhanced monitoring.

AI Analysis on CVE Detail Pages

When you view a CVE detail page, the AI analysis has four sections (Standard tier and above):

Executive Summary

A plain-English description of what this vulnerability does and why it matters. Written for two audiences: OT engineers who need technical detail, and plant managers who need to understand business impact.

ICS Context

What this CVE means specifically for ICS/OT environments. This section answers: "Does this affect my control systems, and if so, how?" It considers the affected vendor, product, protocol, and attack vector in the context of typical OT network architectures.

Remediation Guidance

Step-by-step actions to take, ordered by priority:

  1. Apply the vendor patch if available (with version details).
  2. Implement compensating controls if patching is not immediately feasible.
  3. Monitor for indicators of compromise.
  4. Schedule a follow-up review.

The guidance is specific to OT environments. It does not recommend "restart the service" for a PLC, because restarting a PLC can have physical process impacts.

Confidence Score

A numerical confidence score with a tier classification:

Tier Score Range Meaning
SOVEREIGN_AUDIT_PASS 0.90+ Highest confidence. Multiple corroborating sources.
HIGH 0.75 - 0.89 Strong confidence. Reliable source data.
MEDIUM 0.60 - 0.74 Moderate confidence. Verify with the vendor advisory.
LOW Below 0.60 Limited data available. Treat as directional guidance only.

The confidence score reflects how much source data supports the analysis. AI analysis can be wrong: confirm key claims against the vendor advisory before acting.

Asking the AI Assistant

The AI assistant is available from any page via the green ASK AI button in the bottom right corner. Use it to ask questions about your environments, specific CVEs, remediation strategies, or compliance posture.

Example questions:

  • "What are the highest priority CVEs in my Water Plant Alpha environment?"
  • "Is CVE-2025-32433 relevant to my Siemens S7-1500 PLCs?"
  • "What compensating controls can I use for CVE-2024-38112 if I cannot patch immediately?"
  • "Summarize my NERC CIP exposure for the quarterly review."
  • "Which findings in Substation Beta should I address before the maintenance window on Friday?"
  • "Explain the BCS score breakdown for CVE-2025-32433."
  • "What OPC-UA vulnerabilities should I watch for?"

The assistant responds with ICS-specific context. When you ask about a CVE, it considers your environment assets, the CVE's affected products, exploitation intelligence, and your compliance obligations.

AI Tier Access

Tier AI Access
Free Blurred summary on CVE pages. 5 chat queries/month.
Standard Full analysis on CVE pages. 50 chat queries/month.
Professional Full analysis. 500 chat queries/month. ElevenLabs voice mode.
API Unlimited queries. Programmatic access.
Enterprise Unlimited. Priority processing. Custom model tuning on request.

Voice mode (Professional and above): The assistant can read its analysis aloud using ElevenLabs text-to-speech. Useful for plant floor operators who need to review findings hands-free, or for accessibility.

AI Assistant Query Logging

Every AI assistant query is logged in the audit log as SAGE_QUERIED. The log records the CVE ID and query type. The response content is never logged -- only the fact that a query was made. This ensures that your AI assistant usage is documented for compliance without storing potentially sensitive analysis text in the audit trail.