GreyNoise adopts agentic LLM workflows to scale CVE detection engineering and GreyNoise Tag production
GreyNoise has described a revised detection engineering approach that uses agentic workflows built on frontier large language models to keep pace with rising CVE volumes. The post says CVE entries grew from 16,510 in 2018 to 48,162 in 2025, and that generative AI has contributed to 130% growth from 2022 through 2025. It also claims the mean time to exploit is now slightly negative, so the average vulnerability is likely exploited before it receives a CVE number. The company plans to ingest CVE data and references automatically, query its packet data for related activity, and draft detection logic for GreyNoise Tags, with human engineers reviewing every draft before publication. This is product and methodology news with no specific incident, vulnerability or threat actor.
Detalhes técnicos
- Agents pull the CVE summary, metadata and linked references, then assess criticality (CVSS, KEV, operational impact) and whether existing sensors can capture exploitation.
- Agents score the quality of ingested data. Low-quality CVEs are queued for later re-assessment.
- Above a quality threshold, an agent builds a packet query against GreyNoise data from the Global Observation Grid (GOG) to find recent relevant activity while limiting false positives, then drafts the detection logic.
- Detection engineers review the draft and a summary of the agents' work, and refine and re-evaluate the logic against the data.
- After a Tag is published, agents keep monitoring for new references and propose Tag updates for human review.
- Wider goals include expanding the GOG beyond the edge with Deception Sensors across more platforms, covering all MITRE ATT&CK stages, and proactively hunting for unknown threats.
Linha do tempo
-
GreyNoise adopts agentic LLM workflows to scale CVE detection engineering and GreyNoise Tag production
ler a análise desta fonte ocultar
GreyNoise has described a revised detection engineering approach that uses agentic workflows built on frontier large language models to keep pace with rising CVE volumes. The post says CVE entries grew from 16,510 in 2018 to 48,162 in 2025, and that generative AI has contributed to 130% growth from 2022 through 2025. It also claims the mean time to exploit is now slightly negative, so the average vulnerability is likely exploited before it receives a CVE number. The company plans to ingest CVE data and references automatically, query its packet data for related activity, and draft detection logic for GreyNoise Tags, with human engineers reviewing every draft before publication. This is product and methodology news with no specific incident, vulnerability or threat actor.
Technical Details
- Agents pull the CVE summary, metadata and linked references, then assess criticality (CVSS, KEV, operational impact) and whether existing sensors can capture exploitation.
- Agents score the quality of ingested data. Low-quality CVEs are queued for later re-assessment.
- Above a quality threshold, an agent builds a packet query against GreyNoise data from the Global Observation Grid (GOG) to find recent relevant activity while limiting false positives, then drafts the detection logic.
- Detection engineers review the draft and a summary of the agents' work, and refine and re-evaluate the logic against the data.
- After a Tag is published, agents keep monitoring for new references and propose Tag updates for human review.
- Wider goals include expanding the GOG beyond the edge with Deception Sensors across more platforms, covering all MITRE ATT&CK stages, and proactively hunting for unknown threats.