AISCA for security benchmarks

AISCA stands for AI Security Configuration Assistant and I have created it as a proof-of-concept on a MacOS command line (Python scripts) and then presented in a Python-based GUI as a final tool.

What it does and why

We from cybersecurity trenches all know that joggling with security requirements across OS/network/application layers can be tricky. Even when using something so mature as CIS Benchmarks - the contradictions are real, structural, and unavoidable.

In this PoC I take 3 CIS benchmarks (Ubuntu Server 24.04, Apache HTTP Server 2.4 and MariaDB 10.11) and ask AI to 1. to analyze a provided configuration sample and 2. explain the compliance/non-compliance verdict. 

The configuration sample is composed from distinct requirements from all 3 benchmarks but in a more evolved version of PoC we would be able to paste full config files into AISCA.

All of this is done using a local LLM (qwen3:4B, 4 billion parameters) and running Python scripts on MacOS (Apple Silicon M3 16GB RAM):

Note: the video is shorten to save you time, the actual assessment takes about 2-3 minutes - but only because the local LLM would need a more powerful host to be really quick. But then on the other hand - it would take about the same time for 3 benchmarks as for 30.