RAG Against the Machine: Using Retrieval-Augmented Generation & MCP to Fortify Cybersecurity Defense

The talk opens with the pressures on security operations: alert volume, false positives, staffing gaps and burnout. The speaker argues AI should act as an assistant with a human still in the loop, and that internal data can stay private if retrieval runs in a self-hosted environment rather than a hosted service.

The core of the talk is retrieval-augmented generation, explained through a library analogy. An embedding model turns a question into searchable terms, a vector database holds chunked documents such as ATT&CK techniques, Sigma detections and advisories, and a language model writes the answer from the retrieved passages. Refreshing the index keeps answers current, unlike a static model. Guardrails covered include encrypting the store, filtering inputs and outputs, and logging activity to the SOC, and he noted that judging answer quality is hard.

Demos show an open-source tool that uses Model Context Protocol to connect the model to these sources, mapping a Splunk detection to a MITRE technique and linking related threat intel. A second tool classifies uploaded policies with a BERT-based model to estimate coverage against frameworks such as SOC 2. He closes by urging practitioners to start small, test with their own data and press vendors on cost and token transparency. In Q&A he suggested running open-source models locally to cut costs.