AI System for Preparing Patch Priorities with Business Context

The problem

In day-to-day operations, vulnerability records, asset criticality and patch information arrive through different systems and event records, preventing the team from seeing the case on a single timeline.

As a result, source links can be lost while the reasoned patch priority recommendation is prepared, the case can be routed to the wrong team, and the basis for the technical decision can remain unclear.

An incomplete workflow may overlook a critical internet-exposed system or a compliance exception, while an incorrect system action could cause an outage or leave a vulnerability unresolved by applying the wrong patch.

What we set out to improve

• Time taken for the draft reasoned patch priority recommendation to be ready for specialist review
• Correct referral of records involving a critical internet-exposed system or compliance exception to the appropriate specialist queue
• Record of recommendations corrected or rejected by the system owner and security specialist

How the system works

1. 01 Retrieve vulnerability records, asset criticality and patch information from authorised sources
2. 02 Verify the source, timestamp and record identifier
3. 03 Add the relevant asset, user, shop, vehicle or content context
4. 04 Prepare a draft reasoned patch priority recommendation
5. 05 Compare the draft with technical rules and authority boundaries
6. 06 Check for exceptions: a critical internet-exposed system or compliance exception
7. 07 Obtain the system owner's and security specialist's approval, correction or rejection
8. 08 Write the input, recommendation, changes and final decision to the audit log

Methods we used

• Source- and time-traceable data extraction for vulnerability records, asset criticality and patch information
• Structured output that restricts the reasoned patch priority recommendation fields to technical rules
• An exception gate that separates cases involving a critical internet-exposed system or compliance exception from system action
• An authorised queue that presents the evidence and recommendation together for the system owner and security specialist
• Duplicate-processing controls and a rollback record to address the risk of an incorrect patch causing an outage or leaving a vulnerability unresolved

Where people stay involved

Data and security

Only fields required for the task are processed from vulnerability records, asset criticality and patch information. Source-system permissions are preserved, and unnecessary personal, technical and security-sensitive data is minimised before being sent to the model. Every retrieval, recommendation, human change and target-system action is written to the audit log.

Who this suits

Frequently asked questions