AI in cybersecurity management

In daily cybersecurity management, we often assume that meaningful AI assistance requires massive cloud models, complex pipelines, or enterprise‑grade infrastructure.

I have decided to challenge that assumption by trying to create a simple AI assistant that would help me to map risk, threats, vulnerabilities and controls in my custom made ISMS/GRC tools. I set out with modest expectations and modest hardware—just lightweight, locally running semantic and generative models—and ended up genuinely surprised by how far “home‑built” AI can go.

The goal was simple: create practical, custom AI helpers that support real security decisions, not futuristic magic. And it turns out that even the smallest models can meaningfully assist a cybersecurity practitioner.

We’ll explore how these ideas evolved from command‑line proofs‑of‑concept into working components inside real ISMS/GRC tools—specifically Redmine and TiddlyWiki. Along the way, we’ll compare semantic embeddings with generative reasoning and RAG (Retrieval-Augmented Generation), examine whether traditional TVC mapping is still necessary, and demonstrate how MiniLM, Phi‑3 Mini, and Llama 3.2‑1B can power threat modelling, asset–risk–control mapping, and everyday security workflows.

Our local LLM will be able not only to map controls to vulnerabilities but also answer questions like: "Can I allow a third-party to access our systems with SSH using only passwords?" That is, not a generic, 'best practice" answer from cloud, but conclusions made from our home-made security documents.

This is AI for cybersecurity practitioners—not theoretical, not cloud‑dependent, but practical, local, and surprisingly capable.

See current examples in AISA in ISMS.