Artificial intelligence corroboration of vendor outputs

An artificial intelligence (“AI”) system comprising:

• a processor;
• a memory;
• a first application program interface (“API”) that ingests first output generated by a first vendor tool, the first output comprising:
• a first cyberthreat detected by the first vendor tool;
• and
• a first set of countermeasures that neutralize the first cyberthreat;
• a second API that ingests second output generated by a second vendor tool, the second output comprising:
• a second cyberthreat detected by the second vendor tool;
• and
• a second set of countermeasures that neutralize the second cyberthreat;
• and
• an AI engine that:
• determines when the first output and the second output correspond to a known cyberthreat;
• formulates a set of overlapping countermeasures designed to neutralize the known cyberthreat, wherein each member of the set of overlapping countermeasures is included in the first set of countermeasures and included in the second set of countermeasures;
• formulates a third set of countermeasures including the set of overlapping countermeasures and a combination of countermeasures that is different from countermeasures included in the first and second sets of countermeasures based on the known cyberthreat;
• overrides the first and second sets of countermeasures output by the first and second vendor tools respectively;
• prioritizes deployment of computing resources to deploy the third set of countermeasures to neutralize the known cyberthreat;
• decommissions, without user intervention, the first vendor tool when a first relative complement of a set of first cyberthreats not detected by the first vendor tool includes more members than a second relative complement of a set of second cyberthreats not detected by the second vendor tool;
• and
• decommissions, without user intervention, the second vendor tool when the second relative complement includes more members than the first relative complement.

An artificial intelligence (“AI”) system for corroborating cyberthreats detected by multiple vendor tools, the system comprising:

• a processor;
• a memory;
• and
• a non-transitory computer readable medium including computer code that when executed by the processor:
• extracts attributes from a first cyberthreat detected by a first vendor tool;
• extracts attributes from a second cyberthreat detected by a second vendor tool;
• formulates a set of overlapping attributes, wherein each member of the set of overlapping attributes is included in the attributes extracted from the first and second vendor tools;
• formulates a set of countermeasures including the set of overlapping attributes and countermeasures that are different from the attributes extracted from the first and second vendor tools based on the first and second cyberthreats;
• delays deployment of the set of countermeasures against the first and second cyberthreats until an intersection of the attributes extracted from the first cyberthreat and the attributes extracted from the second cyberthreat exceeds a threshold number of members;
• and
• decommissions the first vendor tool when:
• a set of first cyberthreats detected by the first vendor tool includes a threshold number of known cyberthreats;
• and
• a set of second cyberthreats detected by the second vendor tool includes the threshold number of known cyberthreats and an additional predetermined number of distinct known cyberthreats.