Ask HN: Responsible Use of Agents for Cybersecurity

1 points by teekert 13h ago ↗ HN

Hi HN.

I am a "sys-admin/software dev/anything IT" for some smaller companies. Recently I've been doing a lot of work securing our infra following the PHP madness, weekly GitLab CVEs, and yesterday Tailscale's issues (though they didn't require intervention directly, they prompted me to do research), etc.

Mostly I become aware of these issues through some of my favorite blogs, like HN, but also the Dutch (and very excellent) tweakers.net.

But I think I can automate this more using an agent. I was thinking to give one of my Hermes agents a list of the software we use and regularly check online if there are issues, then if there are, prepare an action plan for me (with sources) and ping me on my mobile phone (ie via ntfy.sh which I already use with Uptime Kuma). Perhaps I could even publish this on my public website, saving others the trouble. Later on I could have have the agent manage some interventions directly (though I'm not ready for that yet.)

But, I know LLMs are killing the internet, so I was wondering how I can do this responsible. How can I instruct (or rather: build) the agent (or rather: the set of scripts that will become the agent [always minimize LLM involvement in recurring tasks, unless edge cases arise!]) best? Are there known APIs equipped to handle the scraping, perhaps even tailored to cybersecurity incidents?

Or maybe I should go about this some other way entirely?

Whatever the case, I was wondering how you people out there handle the CVE load.

All the best out there and stay safe!

2 comments

[ 86.3 ms ] story [ 31.8 ms ] thread

samuelknight 10h ago ↗

Hey, my startup is a platform for automated penetration testing (so white hat hacking of your own infrastructure). There are several straightforward ways to track CVEs, and you can also automate parts of the patching process (such as with dependabot, since you mentioned Github advisories). Those can inform you of specific bugs in common software but doesn't tell you much about your security posture. For example your in house software could be buggy, or your environments could be mis-configured. At this point CVEs are reactionary. Everyone (including criminals) are finding exploits to common software at about the same time which means patches come weeks after the bugs start getting exploited in the wild.

A criminal who thinks you have something worth stealing will set up an agent to attack your systems. The bottom line is that a cheap LLM in 2026 is far more capable than than the best unassisted human hacker. CVEs put both the attacker and defender on notice, but they are are a tiny part of what goes into making a well defended system.

[dead] Ad3t0 6h ago ↗

[flagged]