AI for risk assessment

In this Proof-of-Concept of using local LLM for cybersecurity I have tried to use AI to assess current status of identified risks.

In this home-made ISMS (built upon Redmine) I have a catalog of risks where the assessment of each risk depends on 1. status of related threats, 2. status of vulnerabilities exploitable by these threats and 3. status of controls mitigating those vulnerabilities.

In a real-life scenario, a risk - even when correctly linked to threats, vulnerabilities and controls - is typically assessed without paying attention to TVCs. So an individual who is supposed to follow the correspoding TVCs statuses when assessing a risk takes a shortcut and assigns a residual risk level arbitrarily (subjectively), just to save his/her time.

But here the AI can perform a risk assessment by actually looking up the status of TVCs and then propose a new verdict!

Currently the only problem with this solution is that a standard PC (i5 16GB RAM, no GPU) hosting the AI model (Qwen 3:4B) can take up to 8 minutes to formulate a final recommendation. But we all know that local LLMs need a lot of hardware power to work quickly enough.

Note: One of the options to speed things up would be to get rid of the TVCs hierarchy and map risks directly to controls. Not the best way but in real practice sufficient.