Generative cybersecurity exploit discovery and evaluation

A method for analyzing changes to a computing platform, the method comprising:

• determining first platform information indicative of a first state of the computing platform;
• determining second platform information indicative of a second state of the computing platform,
• wherein the second state is a different state than the first state;
• determining a change in an attack surface based on a difference between first state and second state;
• accessing tactic, technique, and procedure (TTP) information;
• generating, based on the determined change in the attack surface and the TTP information, a prompt for a large language model;
• applying the large language model to the prompt,
• wherein the large language model is configured to generate an output indicative of a vulnerability present in the second state and not present in the first state;
• determining that the vulnerability is exploitable,
• wherein determining that the vulnerability is exploitable comprises identifying one or more exploits for the vulnerability;
• and
• determining a mitigation action for the vulnerability.

A system for analyzing changes to a computing platform, the system comprising:

• at least one hardware processor;
• and
• at least one non-transitory memory storing instructions which, when executed by the at least one hardware processor, cause the system to:
• determining first platform information indicative of a first state of the computing platform;
• determining second platform information indicate of a second state of the computing platform,
• wherein the second state is a different state than the first state;
• determining a change in an attack surface based on a difference between first state and second state;
• accessing tactic, technique, and procedure (TTP) information;
• generating, based on the determined change in the attack surface and the TTP information, a prompt for a large language model;
• applying the large language model to the prompt,
• wherein the large language model is configured to generate an output indicative of a vulnerability present in the second state and not present in the first state;
• determining that the vulnerability is exploitable,
• wherein determining that the vulnerability is exploitable comprises identifying one or more exploits for the vulnerability;
• and
• determining a mitigation action for the vulnerability.