Autonomous Security Vulnerability Governance Agents

Real-time CVE Governance Copilot: autonomous agents that turn threat signals into explainable actions and continuously improve policy in a safe sandbox before production.

Comment

Inspiration

Security teams are overloaded with alerts, but the real bottleneck is turning fragmented risk signals into trusted action quickly.
Most organizations have scanner results, vendor advisories, and incident alerts, yet response still depends on manual triage and ad-hoc escalation.
I wanted to build an agent system that behaves like an autonomous control plane: continuously ingest, reason, act, and improve.

What it does

This project automates a full governance loop for software vulnerability operations.

A CVE is a public ID for a known software security flaw (like a “license plate” for a vulnerability).
This system takes those public vulnerability IDs and turns them into concrete decisions for your environment.

  • Ingests near-real-time vulnerability signals (NVD + optional threat intel)
  • Builds and updates a security knowledge graph
  • Validates policy constraints before action (SHACL gate)
  • Runs risk reasoning queries to generate governance events
  • Produces deterministic decisions (allow, review, block) with evidence
  • Dispatches downstream actions with orchestration controls (dedupe, retry, idempotency)
  • Uses sandbox feedback to auto-tune thresholds and evaluate production readiness

In short: Sense -> Reason -> Act -> Learn.

How I built it

  • FastAPI backend with async runtime loops
  • RDFLib/SPARQL reasoning with Neo4j/Cypher integration path
  • pySHACL for governance validation
  • Deterministic decision layer + action orchestrator
  • Autonomous runtime for feedback-driven threshold tuning and promotion gates
  • Live control-plane UI to show decisions, events, and learning-state changes

I also refactored key parts to be data-driven (runtime config, sandbox scenarios, thresholds, collector defaults) instead of hardcoded flows.

Challenges I ran into

  • Moving from a single vulnerability demo to a reusable multi-vulnerability pipeline
  • Meeting real-time expectations with polling-based public vulnerability sources
  • Balancing “no human intervention” automation with policy-required human review on high-risk paths
  • Reducing UI noise so non-security judges could immediately understand the autonomy loop

Accomplishments that I’m proud of

  • Built a full autonomous governance loop as a solo hackathon build
  • Shipped deterministic, explainable decisions with auditable artifacts
  • Added sandbox-first simulation so policy can be stress-tested safely
  • Integrated Neo4j while preserving RDF/SPARQL fallback for reliability
  • Implemented automatic feedback-driven adaptation rather than static thresholding

What I learned

  • Autonomy without governance constraints is not trustworthy
  • Explainability is essential for security decision adoption
  • Data-driven architecture is critical for speed and extensibility
  • Sandbox feedback loops are the safest way to improve automated policy behavior

What’s next for Autonomous Security Vulnerability Governance Agents

  • Add continuous event ingestion from richer real-time sources
  • Expand policy lifecycle management (versioning, drift detection, controlled rollout)
  • Strengthen evaluation with richer precision/recall and MTTR-style operational metrics
  • Move from sandbox simulation to staged production pilots with role-based controls
  • Add deeper action integrations (ticketing/SOAR/chatops) for closed-loop enterprise operations

Built With

  • airbyte
  • aws-(s3/sqs-optional)
  • cypher
  • fastapi
  • httpx
  • json-schema
  • neo4j
  • openai-api
  • pydantic
  • pyshacl
  • pytest
  • python
  • rdflib
  • render
  • sparql
  • tavily-api
  • uvicorn
Share this project:

Updates