Applying generative AI to CVE remediation

The speakers, both AWS solution architects, start from the strain that CVE handling places on engineering teams. Finding, triaging and fixing vulnerabilities is largely manual, and the workload grows as applications and their dependencies multiply. They set out to automate the most repetitive part of that cycle without changing how teams already build and ship software.

The solution is event driven and serverless. When a container image is pushed to a registry, Amazon Inspector scans it, and the findings flow through EventBridge into DynamoDB. A small task then combines the CVE data, the current requirements file and a template built from earlier manual patches, and asks a Llama model on Amazon Bedrock to produce updated dependency versions. The output is a pull request the developer can review and merge, after which the image is rescanned. The speakers argue that well-built prompts and retrieved context let a smaller, cheaper model perform well on a narrow task.

The talk then looks at extending the pipeline with NVIDIA Morpheus, an open-source security analysis framework running on Kubernetes. It adds source code and SBOM inputs and checks whether a flagged vulnerability is actually exploitable, helping teams separate urgent fixes from ones that can wait. The main takeaways are to patch proactively, keep a human approval step, and treat the approach as a starting point. The code and a published write-up are available for teams to adapt.