Exploit Intelligence with Agentic AI: Patch What Matters

Exploit Intelligence with Agentic AI: Patch What Matters

Speakers: Dmitrijs Trizna (Microsoft)

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=6yrvKdsvn8s

Overview

In an era where cyber threats are escalating in sophistication and scale, this talk by Dmitrijs Trizna from Microsoft addresses the critical asymmetry currently favoring offensive actors in the cybersecurity landscape. Trizna, a seasoned expert with 15 years in infosec and a deep focus on AI for the past five, unpacks how threat actors are rapidly leveraging large language models (LLMs) and artificial intelligence to automate their operations, leading to an unprecedented surge in vulnerabilities and supply chain attacks. The core premise is that traditional, human-centric vulnerability management approaches are no longer scalable or effective against this evolving threat.

The talk proposes a paradigm shift: employing agentic AI to combat this asymmetry by automating and enhancing defensive cybersecurity operations, particularly in the realm of exploit intelligence and vulnerability triage. Trizna details how Microsoft's internal research team is actively exploring and implementing AI-native methods to not only discover vulnerabilities more efficiently but also to process and prioritize exploit intelligence at a scale previously unimaginable. This shift is presented not merely as an incremental improvement but as a fundamental re-architecture of security operations, aiming for a future of self-defending software and a significant reduction in the overwhelming backlog of unaddressed vulnerabilities.

This discussion is highly relevant for security professionals, developers, and anyone involved in vulnerability management, offering a candid look at the current challenges and a forward-thinking vision for leveraging AI as a powerful defensive tool. It emphasizes critical insights into where LLMs excel and where they falter, underscoring the paramount importance of context engineering and the efficacy of simpler, well-designed AI workflows over overly complex agentic systems.

Background

▶ Watch: Introduction to agentic AI and cyber security asymmetry (0:00)

The cybersecurity landscape is currently characterized by a significant and growing asymmetry that heavily favors threat actors. Dmitrijs Trizna highlights that offensive security has seen rapid and substantial benefits from AI adoption, with compelling evidence indicating that state-sponsored actors, ransomware groups, and commercially viable cybercriminals are extensively employing LLMs to automate their daily operations. While companies like Anthropic and OpenAI attempt to limit malicious use of their models, open-source alternatives like Deepseek are freely available, easily fine-tuned, and likely running 24/7 in hostile environments. Google's DeepMind report corroborates this trend, noting a significant decrease in the cost and effort required for threat actor activities such as distributed denial-of-service (DDoS) attacks, sophisticated phishing campaigns, and malware creation, primarily driven by LLM usage.

This offensive advantage is compounded by an alarming growth in the number of disclosed Common Vulnerabilities and Exposures (CVEs). Trizna points out that only 4% of npm packages have had vulnerabilities disclosed in the past, leaving a staggering 95% potentially unexamined by human security experts. This vast, unexplored attack surface is becoming increasingly tractable with AI-native vulnerability discovery approaches. Microsoft's own research team, for instance, has achieved remarkable success, identifying over 100 vulnerabilities and securing more than 10 CVEs in high-profile targets like OpenSSL (three CVEs in one month), Signal, and the Linux kernel through AI-driven methods.

Furthermore, the coupling of code and language automation capabilities in LLMs has introduced severe supply chain risks. AI can enable attackers to mimic legitimate developers, contributing malicious code across numerous projects simultaneously. The infamous XZ backdoor case, where a malicious actor contributed to the project for months before planting a backdoor, exemplifies this danger. Other incidents include a worm that impacted 100 packages and the debug and chalk library cases, which affected 50,000 customers. Trizna's team demonstrated the alarming efficiency of AI in this context, detecting a backdoor in the chalk library for just $2 and in merely six minutes.

Against this backdrop, conventional vulnerability management methods are proving utterly inadequate. The traditional process involves human security analysts manually consuming public news, exploit databases, and internal code to identify and triage vulnerabilities. This leads to a substantial "trash process" where many reported vulnerabilities are irrelevant, and a massive backlog of unaddressed CVEs. Trizna has spoken with CISOs of public companies managing millions of CVEs in their networks, a scale that is simply not tractable with current human-intensive methods. The minimal automation and ever-growing backlog underscore the urgent need for a transformative approach.

Key Findings

▶ Watch: AI for vulnerability discovery: 100+ vulnerabilities found (4:00)

The talk reveals several pivotal findings regarding the application of AI, particularly agentic AI, in cybersecurity:

• AI-Driven Asymmetry Favors Attackers, but Can Be Leveraged Defensively: Threat actors are rapidly adopting LLMs for offensive operations, creating a significant imbalance. However, AI, when strategically implemented, offers a powerful countermeasure for defenders, enabling scalable and efficient security operations.
• Agentic AI Significantly Enhances Vulnerability Triage and Exploit Intelligence: By automating the filtering, assessment, and even remediation proposal stages, AI agents can drastically reduce the human workload in vulnerability management, allowing security teams to address hundreds or thousands of vulnerabilities where previously only tens were manageable.
• Context Engineering is Paramount: The most critical factor for the effective performance of LLMs and agentic systems is how information—or "context"—is prepared and presented to them. Too much information, or irrelevant data, demonstrably degrades performance and leads to suboptimal outcomes. Mastering context engineering is essential for extracting desired results from LLMs.
• LLMs Are Inefficient for Raw Data Scraping/Collection: Despite their language capabilities, LLMs are slow and expensive for tasks like web scraping or deterministic data collection. Specialized tools, private threat intelligence feeds, or custom deterministic code are far more efficient and comprehensive for gathering raw vulnerability information.
• LLMs Excel at Aggregation and Heuristic Assessment: Where LLMs truly shine is in their ability to holistically assess and synthesize diverse, unstructured contexts. They can combine application-specific details (reachability, exploitability), organizational context (asset location, access, internal communications), and external exploit intelligence to provide a nuanced, calibrated risk score for vulnerabilities. Their format agnosticism also dramatically speeds up the integration of new data sources.
• Simplicity Often Outperforms Complexity in Agentic Systems: Overly complex agent-to-agent communication protocols or multi-agent architectures are frequently less effective than simpler "workflow paradigms." This approach involves targeted LLM calls with meticulously engineered contexts, glued together by deterministic, conventional code, proving more robust and efficient for 70-80% of use cases.
• The Vision of Self-Defending Software is Achievable: By continuously integrating AI into vulnerability discovery, triage, and remediation loops with minimal human involvement, it is possible to move towards a future where software can automatically detect and fix its own bugs, ultimately leading to a "zero vulnerability backlog."

Technical Deep Dive

▶ Watch: AI's role in escalating supply chain attacks (5:00)

The technical core of Trizna's talk revolves around countering the burgeoning AI-driven offensive capabilities with sophisticated defensive applications of agentic AI. The speaker meticulously dissects the problem, the limitations of traditional methods, and the proposed AI-native solutions.

The AI Asymmetry and Offensive Adoption:

Trizna first establishes the scale of the problem. Threat actors are leveraging LLMs for a wide array of offensive operations:

• Cost Reduction: Google's DeepMind report indicates LLMs significantly reduce the cost of activities like DDoS attacks, phishing campaigns, and malware creation.
• Accessibility: Open-source LLMs like Deepseek are readily available, enabling continuous, automated malicious operations.
• Vulnerability Discovery: AI is not just for exploitation; it's also for finding vulnerabilities. Microsoft's internal team, using AI-native approaches, has found over 100 vulnerabilities and secured 10+ CVEs in just one month, targeting high-value projects like OpenSSL, Signal, and the Linux kernel. This demonstrates AI's capability to make the "95% of npm packages without reported vulnerabilities" tractable.
• Supply Chain Attacks: LLMs facilitate large-scale supply chain attacks by enabling attackers to mimic developers and inject malicious code. The XZ backdoor (planted after months of legitimate-looking contributions) and the debug and chalk library incidents (where a backdoor was detected for $2 in 6 minutes) illustrate the speed and stealth of these AI-enabled threats.

Limitations of Conventional Vulnerability Management:

Traditional vulnerability management is depicted as a fundamentally unscalable, human-intensive process:

1. Manual Correlation: A human security analyst consumes public news, known exploit databases, and internal code.
2. Triage Overload: Thousands of vulnerabilities land on the analyst's desk, many of which are "nonsensical" or irrelevant to the organization, requiring a manual "trash process."
3. Developer Burden: Relevant vulnerabilities are then passed to developers or service owners for manual remediation.
4. Backlog Growth: This cycle repeats for thousands, if not millions, of CVEs, leading to unmanageable backlogs.

Agentic AI for Vulnerability Triage:

The proposed solution is to inject AI agents into this process to automate and scale. The vision involves multiple agents working collaboratively, supervised by humans, to achieve significant cost reduction and efficiency gains.

• Automated Filtering: An AI bot can filter out irrelevant vulnerabilities with minimal human involvement.
• Remediation Proposals: When a vulnerability is deemed relevant, the bot can propose remediation fixes.
• Developer Integration: These proposed fixes can be integrated directly into developer workflows, leveraging existing unit tests and validation services. This shifts the developer's role from finding and fixing to merely validating AI-generated patches.
• Continuous Loop: The ultimate goal is a continuous scanning and remediation loop, pushing towards "self-defending software" where bugs are automatically identified and fixed, whether they arise from mistakes or malicious intent.

Exploit Intelligence with Agents:

Exploit intelligence, a critical piece of the vulnerability management puzzle, is where AI agents can yield significant benefits. The challenge is processing an overwhelming stream of information (e.g., the F5 source code release or a SharePoint vulnerability disclosure). The objective is to assign a relevance score (e.g., 0-10) to each vulnerability for an organization.

• Traditional Approach: Humans parse exploit sources and apply them to the organization's vulnerability lineage, or more mature organizations use cached, local storage of exploit information for rapid consumption.
• Agentic Approach – The Two Stages:

1. **Scraping/Collection (Where LLMs are Bad):** Trizna emphatically states that LLMs are not suitable for scraping or raw data collection. They are "slow" and "expensive" for this task. Private feeds or deterministic methods (e.g., a custom script to "search GitHub with a CVE") are far more efficient and comprehensive. The problem is not feeding LLMs raw data (they can consume it), but rather the inefficiency of using them to collect that data when better, faster methods exist. The key is pre-filtering and providing only relevant information to the LLM.
2. **Aggregation/Heuristics (Where LLMs Shine):** This is the sweet spot for AI agents. LLMs excel at holistic assessment by synthesizing diverse contexts:

• Application Context: Details about the application, its reachability, and exploitability.
• Organizational Context: Where the application lives in the network, its access privileges, and even internal discussions (e.g., Slack) about it.
• Exploit Intelligence: External data about the vulnerability's exploit status.

LLMs can calibrate these contexts to provide a nuanced risk assessment. For example, a deep network vulnerability that is actively exploited might be prioritized over a customer-facing one that isn't yet.

• Format Agnosticism: A major advantage is that LLMs don't care about data format. They can consume markdown, JSON, or any other structure without needing custom parsers, drastically reducing the time (from days to minutes) to integrate new exploit sources.
• Simple No-Tools Approach (Workflow Paradigm): Trizna advocates for a "workflow paradigm" over complex, multi-agent architectures (where one agent calls another). This involves making targeted LLM calls with carefully constructed contexts, then using deterministic, "vanilla code" to glue these calls together. This simpler approach, often beating complex agentic workflows, is effective for 70-80% of use cases.

Context Engineering:

This is highlighted as the "most essential thing." An agent's functionality is essentially building the right context for a final LLM call. Whether it's a research mode in ChatGPT making tool calls to gather information about apartments, or an exploit intelligence agent querying various sources, all these actions are about building a proper, relevant context for the LLM to make its final decision. Too much or irrelevant information significantly degrades LLM performance, a fact supported by extensive academic research.

Architectural Example for High-Quality Context:

The talk illustrates an architecture where data from various sources is collected. Each source might be informed by agents or workflows, but the ultimate goal is to feed a final LLM call with a "much more informed context that doesn't have anything unnecessary and contains only the core information it needs" to generate a precise exploit intelligence score.

In essence, the technical deep dive reveals a pragmatic approach to agentic AI: leverage LLMs for their strengths in contextual understanding and aggregation, carefully manage their limitations in raw data collection, and prioritize simplicity and rigorous context engineering for optimal defensive outcomes.

Demo / Proof of Concept

▶ Watch: Current manual and inefficient vulnerability triage process (7:00)

While the talk did not feature a live, interactive demonstration of an agentic AI system, Dmitrijs Trizna provided compelling evidence and concrete examples of the capabilities and efficacy of their AI-native approaches within Microsoft. These serve as powerful proofs of concept for the concepts discussed:

• Vulnerability Discovery at Scale: Trizna highlighted the success of Microsoft's internal research team, which, by focusing on AI-native vulnerability discovery, identified "100 plus vulnerabilities" and secured "10 plus CVEs" in just one month. These were not obscure projects but high-target, critical software like OpenSSL (where three CVEs were found), Signal, and the Linux kernel. This directly validates the potential of AI to make the vast, unexamined attack surface (e.g., the 95% of npm packages without reported vulnerabilities) tractable.
• Rapid Backdoor Detection: A specific example cited was the detection of a backdoor in the chalk library. The process cost "only $2" and took "six minutes" to identify. This demonstrates the speed, efficiency, and cost-effectiveness of AI in identifying sophisticated supply chain attacks, which are increasingly enabled by offensive AI.
• Addressing Real-World Security Incidents: The talk referenced recent critical security events, such as the F5 source code release and a SharePoint vulnerability, as scenarios where immediate, AI-driven exploit intelligence would be crucial for rapid assessment and response. While not a direct demo, these examples underscore the real-world applicability and urgency for the solutions presented.

These examples, drawn directly from Microsoft's operational experience, serve as strong internal validations for the agentic AI methodologies proposed, demonstrating their ability to deliver tangible security improvements in vulnerability discovery, threat detection, and exploit intelligence.

Defensive Implications

▶ Watch: Millions of CVEs make manual triage intractable (8:00)

The insights shared by Dmitrijs Trizna carry profound implications for defensive cybersecurity strategies, urging a proactive and intelligent integration of AI to counter the escalating threat landscape:

• Strategic AI Adoption is Non-Negotiable: Defenders can no longer afford to ignore or slowly adopt AI. To counter the significant asymmetry created by offensive AI, security teams must strategically implement AI-native approaches in their workflows. The "status quo looks poorly" if AI isn't properly integrated.
• Prioritize Context Engineering: This is the single most critical takeaway. Security teams must invest heavily in understanding and mastering how to prepare, filter, and present information to LLMs. Developing expertise in crafting precise, relevant contexts will directly translate to higher performance and more accurate outputs from AI agents, avoiding the pitfalls of irrelevant or excessive data.
• Selective and Pragmatic LLM Utilization: Defenders should not use LLMs for every task. They are inefficient and expensive for raw data scraping or deterministic information retrieval. Instead, leverage private threat intelligence feeds, specialized tools, or custom deterministic code for collection, and reserve LLMs for their strengths in complex aggregation, heuristic assessment, and contextual understanding.
• Embrace the Workflow Paradigm: Overly complex, multi-agent architectures should be approached with caution. The talk advocates for a "simple is better than complex" philosophy, suggesting that combining targeted LLM calls (with expertly engineered contexts) with robust, deterministic "vanilla code" often yields superior and more reliable results for a majority of use cases.
• Automate Vulnerability Triage and Remediation: Implement AI agents to filter out irrelevant vulnerabilities, drastically reducing the human burden and backlog. Furthermore, leverage AI to propose remediation fixes, integrating directly into developer workflows. This shifts the focus from manual fixing to validation, accelerating the patch cycle and freeing up human experts for more complex tasks.
• Enhance Exploit Intelligence with Holistic Assessment: Utilize AI to ingest and synthesize diverse information—application context, organizational context, and external exploit intelligence—to provide a calibrated, nuanced risk score for vulnerabilities. This enables security teams to prioritize patching efforts more effectively, focusing on what truly "matters" and is most exploitable in their specific environment.
• Strive for Continuous Security and Self-Defending Software: The ultimate goal is to establish a continuous loop of AI-driven vulnerability discovery, triage, and remediation. This paradigm shift, while ambitious, holds the promise of moving towards self-defending software that can automatically detect and fix its own bugs, eventually leading to a "zero backlog" of vulnerabilities.
• Reduce Time-to-Patch for Critical Threats: By automating and accelerating the identification, assessment, and even initial remediation of vulnerabilities, AI can significantly reduce the window of opportunity for attackers, especially against emerging or actively exploited threats.

In essence, the defensive implications are clear: integrate AI intelligently, focus on core principles like context engineering, and automate where AI excels, to build more resilient and responsive cybersecurity defenses capable of combating the evolving threat landscape.

Key Takeaways

• AI-Driven Asymmetry: Threat actors are rapidly adopting LLMs for offensive operations, creating a significant imbalance in cybersecurity that defenders must counter with strategic AI adoption.
• Agentic AI for Scale: Agentic AI offers a viable path to automate and scale vulnerability triage and exploit intelligence, moving beyond human-centric methods that cannot keep pace with the growing volume of CVEs and sophisticated attacks.
• Context Engineering is Paramount: The effectiveness of LLMs and AI agents hinges on meticulous context engineering; providing the right, relevant information in an optimal format is more crucial than complex agent architectures.
• Selective LLM Use: LLMs are powerful for aggregation, heuristic assessment, and understanding diverse contexts, but they are inefficient and expensive for raw data scraping or deterministic information collection, where traditional methods or specialized tools excel.
• Simplicity Over Complexity: In agentic design, a "workflow paradigm" combining targeted LLM calls with deterministic code often outperforms overly complex, multi-agent systems, emphasizing practical, robust solutions.
• Vision of Self-Defending Software: The ultimate goal is to leverage AI for continuous vulnerability discovery, triage, and automated remediation, paving the way for self-defending software and eliminating the pervasive backlog of unaddressed vulnerabilities.

About the Speaker(s)

Dmitrijs Trizna is a distinguished cybersecurity professional with approximately 15 years of experience in information security. His expertise has evolved significantly over the last five years, with a dedicated focus on AI, even before the widespread adoption of models like Llama. Trizna has a strong background in defensive security, having contributed to defending Microsoft's Azure backend. He is currently a key member of an AI-focused research team at Microsoft, exploring how to employ agents for tackling the most critical cybersecurity problems, with exploit intelligence being a primary area of his work. His insights have been shared at prestigious conferences such as Black Hat and DEF CON, underscoring his standing as a leading voice in the intersection of AI and cybersecurity.