AI Security Consultant: AI-Based Adviser for Stronger Cyber Resilience in SMEs

Marc Rennhard

Marc Rennhard, Ümit Yoker

Cybercriminals are increasingly targeting also small and medium-sized enterprises (SMEs). Unlike large companies, which are often well equipped to defend themselves against online threats and have dedicated expert teams, SMEs frequently lack the financial and human resources needed for adequate protection. Established standards do exist, such as the IT-Grundschutz (IT Baseline Protection) framework issued by Germany’s Federal Office for Information Security (BSI). However, such recommendations are deliberately general and must be adapted to each company’s specific circumstances. For many SMEs, making that adaptation is a hurdle: Which internal systems are actually at risk in a cyberattack? Which vulnerabilities are particularly critical? Which measures should businesses implement first?

Strengthening the Cyber Resilience of Small and Medium-Sized Enterprises

The AI Security Consultant [1] is designed to address precisely this gap. The AI-based adviser, currently being developed as part of CYRENZH by the Information Security research group at the Institute of Computer Science of the ZHW School of Engineering, aims to provide SMEs with largely automated, tailored analyses and solutions to cyber threats. Rather than offering generic advice and extensive checklists, the AI Security Consultant assesses a company’s specific security posture, identifies relevant vulnerabilities and risks, and recommends concrete, easy-to-understand measures.

Identifying Specific Security Vulnerabilities and Providing Tailored Solutions

The AI Security Consultant operates in three phases: data collection, vulnerability and risk analysis, and the generation of security measures.

1. Collecting Security-Relevant Data

As a first step, the AI Security Consultant gathers a comprehensive overview of the company’s security-relevant information. Key systems and services, as well as essential software, are identified through scans. Publicly accessible data and information, for example from commercial registers or the company website, are also collected automatically. This information helps build a better understanding of the company’s organization, IT infrastructure, and attack surface. The AI Security Consultant also uses questionnaires to determine organizational processes and responsibilities within the business. All this information is then used to create a digital twin – a digital representation of the company limited to its security-relevant aspects.

2. Identifying Vulnerabilities and Assessing Risks

Based on the digital twin, the actual security analysis is performed in the second step. First, all available information is automatically checked for potential vulnerabilities. Typical security weaknesses include inadequately protected user accounts, outdated software, and insecure configurations. The identified vulnerabilities are then assessed in terms of their actual risk: The likelihood that a security gap will provide cybercriminals with an entry point, and the potential damage they could cause, vary significantly from company to company. Not every vulnerability poses the same threat to every SME. For example, the absence of rate limiting – the restriction of the number of permitted requests per user or IP address within a given period – poses a greater risk to an online shop with a publicly accessible sales function than to a small craft business with a purely informational website and no customer portal. Automated attacks could severely disrupt the site’s availability or core business processes in the former case, while the consequences for the latter would be relatively limited. In the illustrated example, three security vulnerabilities with different risk levels were identified.

3. Tailored Measures and Step-by-Step Instructions

Based on the risks identified and classified in this way, specific security measures are generated automatically in a third step and translated into clear, easy-to-follow step-by-step instructions. For example, the AI Security Consultant does not simply point out that multi-factor authentication should be improved; it specifies exactly which settings need to be changed on which systems. Users can refine the instructions further by asking follow-up questions through a chatbot. As a general rule, the proposed measures should not only be technically effective but also feasible given the resources, systems, and expertise available within the company – as illustrated in the example.

Finally, all security measures implemented are fed back into the digital twin and therefore into a new round of checks and assessments. This continuous cycle of vulnerability identification, risk analysis, and new security measures gradually increases a company’s cyber resilience.

Large Language Models for All Three Functional Phases

Several components of the AI Security Consultant have already been implemented and tested in specific use cases, and initial findings were recently published [2]. The prototype is based on more than 300 security-relevant criteria, and its vulnerability analysis currently covers three categories: password security (e.g., missing multi-factor authentication), outdated or unpatched software (e.g., old operating systems), and security issues on company websites (e.g., sensitive data accessible to the public).

Large language models (LLMs) are used in all three phases. Depending on the situation, the AI Security Consultant uses locally hosted or cloud-based models. The former are used to analyze sensitive company data and conduct vulnerability and risk assessments. Cloud-based language models, on the other hand, are used for data preparation and for generating security measures and step-by-step instructions, as they produce higher-quality results.

Developing a Market-Ready Product with an Industry Partner

The research findings to date show that the AI Security Consultant can, in principle, both identify vulnerabilities and assess risks accurately. Improvements are currently needed primarily in the step-by-step instructions. Although the instructions work, they are not yet sufficiently detailed or tailored closely enough to specific company circumstances.

In the next phase, the AI Security Consultant will be expanded into a comprehensive and even more automated solution. This will include additional security categories and process optimizations. Deployment of the prototype in real companies is also planned to enable a comprehensive evaluation. However, how quickly the AI Security Consultant becomes a market-ready product will depend largely on the opportunity to collaborate with an industry partner, for example through a joint Innosuisse project. Interested companies are warmly invited to get in touch about a potential collaboration, preferably by email to Marc Rennhard ().

References