The Structuring Revolution in Vulnerability Intelligence: AI Semantic Matching Against Enterprise Assets

A Security Team's Day Used to Start with Reading Vulnerability Bulletins

For the security team of a large enterprise group, every day used to start with "reading vulnerability bulletins": security engineers had to manually monitor multiple vulnerability disclosure channels, judge one by one whether "this vulnerability is relevant to our assets," and then manually notify the responsible system owners. With too many vulnerabilities and too few people, response speed was perpetually bottlenecked by "manual monitoring plus manual judgment."

Today, AI has rebuilt this chain: vulnerability information is ingested in real time, NLP automatically cleans and structures it, AI semantic analysis matches it against enterprise assets, and hits immediately generate risk alerts pushed to the responsible parties. The entire pipeline — collection, analysis, and alerting — is now automated. The security team has shifted from "human eyeballs on every bulletin" to "focused triage," with dramatically faster response and a significantly lighter manual monitoring burden.

Background and Pain Points

Vulnerability intelligence work suffers from three industry-wide problems.

First, the sheer volume makes manual tracking impossible. Tens of thousands of vulnerabilities are publicly disclosed every year, spread across authoritative sources such as CVE (Common Vulnerabilities and Exposures), NVD (the national vulnerability database maintained by the U.S. National Institute of Standards and Technology), and CNVD (China National Vulnerability Database). No security engineer can follow every channel in real time; they can only sample, and missed alerts are inevitable.

Second, vulnerability descriptions are unstructured, and matching relies on experience. A vulnerability bulletin is usually a paragraph of natural language covering products, components, versions, and attack vectors. Judging "does this vulnerability affect our assets" requires first understanding the bulletin, then cross-referencing the asset inventory, then inferring from experience. New hires struggle; even veterans miss things.

Third, the response chain is long and alerts lag. From public disclosure to internal alert, the process passes through "discovery — analysis — notification — remediation," with manual handoffs measured in days. Attackers often attempt exploitation within hours of disclosure — the narrower the time window, the greater the risk.

For enterprise groups, the larger and more diverse the asset base, the more complex vulnerability-asset correlation becomes. What a security team needs is not "more data" but "data turned into alerts that can be acted on directly."

What We Did

The project automated the entire vulnerability intelligence chain across four steps: collect, structure, match, alert.

Step 1: real-time collection. We connected to authoritative vulnerability databases — CVE, NVD, CNVD — plus vendor security bulletins and other multi-source channels, syncing the latest vulnerability information in real time to capture the first disclosure window.

Step 2: NLP cleaning and structuring. Natural language processing parses each bulletin, extracting key elements such as vulnerability ID, affected products, components, version ranges, severity, and attack vectors — converting unstructured text into structured data and building a unified vulnerability intelligence repository.

Step 3: AI semantic analysis to match enterprise assets. This is the heart of the solution. Structured vulnerability intelligence is semantically matched against the enterprise asset inventory (systems, middleware, databases, endpoints, etc.) — not simple keyword comparison, but an understanding of the real correspondence between "the component this vulnerability describes" and "the component installed in our asset inventory," including whether the version range is hit. A hit marks that asset as having a security concern.

Step 4: risk alerts and closed-loop remediation. Identified security concerns automatically generate risk alerts, pushed to the responsible system owners in priority order by severity. Remediation results flow back into the system, forming a closed loop of "detect — alert — remediate — close," with the security posture visible at a glance.

On the engineering side, the project emphasized "better to over-alert than to miss." Semantic matching uses a lenient threshold with human review as a safety net to avoid missed alerts; uncertain matches land in a "to confirm" list for quick triage by security engineers, balancing alert precision and coverage.

Results

• Much faster response: from public disclosure to internal alert, the lead time dropped from days of manual handoffs to minutes of automated push — seizing the exploitation time window.

• Significantly lighter manual monitoring: security engineers are freed from "watching multiple sources and judging every bulletin," and can focus on remediation and verification of high-severity vulnerabilities.

• Broader coverage, fewer misses: multi-source real-time ingestion plus full-coverage semantic matching replaces manual sampling, dramatically widening intelligence coverage.

• Lower security management cost: full pipeline automation removes repetitive work, letting a smaller team cover a larger asset surface.

• Traceable closed loop: every step from alert to closure is retained, making the security posture measurable and reviewable, with data to support management decisions.

Lessons Learned: From Project to OntiCards

This project distilled three reusable methodologies. First, structuring is the prerequisite for automation: only after NLP turns unstructured bulletins into structured data can matching, alerting, and reporting build on solid ground. Second, semantic matching beats keyword matching: understanding the real correspondence between components and versions reduces both false positives and missed alerts. Third, automation needs a human safety net: a lenient threshold plus a "to confirm" list lets machines handle the volume while people control the quality.

These lessons became OntiCards' solution capability in security and risk management. More broadly, structuring external intelligence and then semantically correlating it with internal enterprise knowledge follows the same logic as OntiCards' four-layer architecture — turning data into AI-comprehensible assets. To see what "AI-ready data" should look like, read our data readiness practice.