# US 2026/0100964 A1 · Generative systems and methods for adaptive vulnerability management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0100964 A1 - Document ID: US20260100964A1 - Status: Published application - Kind: A1 - Application number: 18/908,753 - Filed: 2024-10-07 - Published: 2026-04-09 - Earliest claimed: 2024-10-07 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: James Cooper Richard - Web page: https://patentgrep.com/patent/US20260100964A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are disclosed comprising instructions to collect vulnerability information over a network from a publishing source, collect network asset information of a communications network, generate a self-executing scanner agent configured to automatically scan the communications network for a known vulnerability based on an input including the collected vulnerability information and the collected network asset information, deploy the scanner agent at any network assets of the communications network that match a particular type of network asset indicated in the collected vulnerability information, generate a record including an indication of a particular network asset of the communications network in association with the known vulnerability in response to the scanner agent executing and detecting the known vulnerability in the particular network asset, and store the record in a data repository that aggregates records of detected known vulnerabilities in association with network assets of the communications network. ## Claims ### Claim 1 A method for generating custom scanner agents for vulnerability management of a computer system, the method comprising: collecting vulnerability information over a network from a publishing source, wherein the vulnerability information includes common vulnerabilities and exposures (CVEs) published on a public repository, and wherein the CVEs include a known vulnerability for a particular type of network asset; collecting network asset information of a communications network, the communications network being subject to the vulnerability management, wherein the network asset information includes information about multiple types of network assets deployed in the communications network; generating, using a generative artificial intelligence (AI) system, based on an input including the collected vulnerability information and the collected network asset information, a self-executing scanner agent configured to automatically scan the communications network for the known vulnerability; deploying the scanner agent at any network assets of the communications network that match the particular type of network asset indicated in the collected vulnerability information; in response to the scanner agent executing and detecting the known vulnerability in a particular network asset of the communications network, generating a record including an indication of the particular network asset in association with the known vulnerability; and storing the record in a data repository that aggregates records of detected known vulnerabilities in association with network assets of the communications network. ### Claim 2 (depends on 1) The method of claim 1 further comprising: configuring a similarity parameter between the multiple types of network assets deployed in the communications network and the particular type of network asset; configuring a first threshold for the similarity parameter that, when exceeded, associates the scanner agent with a network asset of the communications network; and configuring a second threshold for the scanner agent that, when exceeded, causes the scanner agent to self-execute scanning the network asset that exceeds the first threshold. ### Claim 3 (depends on 1) The method of claim 1, wherein the scanner agent is a first scanner agent and the particular type of network asset is a first type of network asset, the method further comprising: calculating a correlation value between the known vulnerability and a second type of network asset of the communications network; discovering a potential vulnerability for the second type of network asset based on the correlation value; generating a second scanner agent configured to self-execute scanning of the communications network for the potential vulnerability; and training the generative AI system based on the records aggregated at the data repository and the potential vulnerability. ### Claim 4 (depends on 3) The method of claim 3, wherein calculating the correlation value comprises: calculating a similarity score between the first type of network asset and the second type of network asset; or calculating a relevance score for the second type of network asset relative to the known vulnerability; and identifying the potential vulnerability based on the similarity score or the relevance score. ### Claim 5 (depends on 1) The method of claim 1, wherein the publishing source comprises: a public national vulnerability database (NVD) that obtains the vulnerability information from a vendor of the particular type of network asset; or a vendor of the particular type of network asset and the vulnerability information is obtained directly from the vendor. ### Claim 6 (depends on 5) The method of claim 5, wherein the publishing source comprises a vendor of the particular type of network asset, and collecting the vulnerability information comprises: automatically obtaining vulnerability information periodically from a website administered by the vendor. ### Claim 7 (depends on 1) The method of claim 1, wherein the particular network asset is a software asset, the method further comprising: deploying a software patch for the software asset to remove a risk of the known vulnerability. ### Claim 8 (depends on 1) The method of claim 1 further comprising: estimating a financial risk of the known vulnerability to an operator of the communications network by performing a risk valuation of the known vulnerability on the particular network asset. ### Claim 9 A vulnerability management system comprising: at least one hardware processor; and at least one non-transitory memory storing instructions, which, when executed by the at least one hardware processor, cause the vulnerability management system to: collect vulnerability information over a network from a publishing source, wherein the vulnerability information includes common vulnerabilities and exposures (CVEs) published on a public repository, and wherein the CVEs include a known vulnerability for a particular type of network asset; collect network asset information of a communications network, the communications network being subject to the vulnerability management system, wherein the network asset information includes information about multiple types of network assets deployed in the communications network; generate, using a generative artificial intelligence (AI) system, based on an input including the collected vulnerability information and the collected network asset information, a self-executing scanner agent configured to automatically scan the communications network for the known vulnerability; deploy the scanner agent at any network assets of the communications network that match the particular type of network asset indicated in the collected vulnerability information; in response to the scanner agent executing and detecting the known vulnerability in a particular network asset of the communications network, generate a record including an indication of the particular network asset in association with the known vulnerability; and store the record in a data repository that aggregates records of detected known vulnerabilities in association with network assets of the communications network. ### Claim 10 (depends on 9) The vulnerability management system of claim 9 further caused to: configure a similarity parameter between the multiple types of network assets deployed in the communications network and the particular type of network asset; configure a first threshold for the similarity parameter that, when exceeded, associates the scanner agent with a network asset of the communications network; and configure a second threshold for the scanner agent that, when exceeded, causes the scanner agent to self-execute scanning the network asset that exceeds the first threshold. ### Claim 11 (depends on 9) The vulnerability management system of claim 9, wherein the scanner agent is a first scanner agent and the particular type of network asset is a first type of network asset, the system further caused to: calculate a correlation value between the known vulnerability and a second type of network asset of the communications network; discover a potential vulnerability for the second type of network asset based on the correlation value; generate a second scanner agent configured to self-execute scanning of the communications network for the potential vulnerability; and train the generative AI system based on the records aggregated at the data repository and the potential vulnerability. ### Claim 12 (depends on 11) The vulnerability management system of claim 11, wherein calculating the correlation value comprises causing the system to: calculate a similarity score between the first type of network asset and the second type of network asset; or calculate a relevance score for the second type of network asset relative to the known vulnerability; and identify the potential vulnerability based on the similarity score or the relevance score. ### Claim 13 (depends on 9) The vulnerability management system of claim 9, wherein the publishing source comprises: a public national vulnerability database (NVD) that obtains the vulnerability information from a vendor of the particular type of network asset; or a vendor of the particular type of network asset and the vulnerability information is obtained directly from the vendor. ### Claim 14 (depends on 13) The vulnerability management system of claim 13, wherein the publishing source comprises a vendor of the particular type of network asset, and collecting the vulnerability information comprises causing the system to: automatically obtain vulnerability information periodically from a website administered by the vendor. ### Claim 15 At least one non-transitory, computer-readable storage medium carrying instructions, which, when executed by a vulnerability management system, cause the vulnerability management system to perform operations for identifying a vulnerability of a computer asset, the operations comprising: collecting vulnerability information over a network from a publishing source, wherein the vulnerability information includes common vulnerabilities and exposures (CVEs) published on a public repository, and wherein the CVEs include a known vulnerability for a particular type of network asset; collecting network asset information of a communications network, the communications network being subject to the vulnerability management system, wherein the network asset information includes information about multiple types of network assets deployed in the communications network; generating, using a generative artificial intelligence (AI) system, based on an input including the collected vulnerability information and the collected network asset information, a self-executing scanner agent configured to automatically scan the communications network for the known vulnerability; deploying the scanner agent at any network assets of the communications network that match the particular type of network asset indicated in the collected vulnerability information; in response to the scanner agent executing and detecting the known vulnerability in a particular network asset of the communications network, generating a record including an indication of the particular network asset in association with the known vulnerability; and storing the record in a data repository that aggregates records of detected known vulnerabilities in association with network assets of the communications network. ### Claim 16 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein the system is further caused to: configure a similarity parameter between the multiple types of network assets deployed in the communications network and the particular type of network asset; configure a first threshold for the similarity parameter that, when exceeded, associates the scanner agent with a network asset of the communications network; and configure a second threshold for the scanner agent that, when exceeded, causes the scanner agent to self-execute scanning the network asset that exceeds the first threshold. ### Claim 17 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein the scanner agent is a first scanner agent and the particular type of network asset is a first type of network asset, the system further caused to: calculate a correlation value between the known vulnerability and a second type of network asset of the communications network; discover a potential vulnerability for the second type of network asset based on the correlation value; generate a second scanner agent configured to self-execute scanning of the communications network for the potential vulnerability; and train the generative AI system based on the records aggregated at the data repository and the potential vulnerability. ### Claim 18 (depends on 17) The non-transitory, computer-readable storage medium of claim 17, wherein calculating the correlation value comprises causing the system to: calculate a similarity score between the first type of network asset and the second type of network asset; or calculate a relevance score for the second type of network asset relative to the known vulnerability; and identify the potential vulnerability based on the similarity score or the relevance score. ### Claim 19 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein the particular network asset is a software asset, the system further caused to: deploy a software patch for the software asset to remove a risk of the known vulnerability. ### Claim 20 (depends on 15) The non-transitory, computer-readable storage medium of claim 15, wherein the system is further caused to: estimate a financial risk of the known vulnerability to an operator of the communications network by performing a risk valuation of the known vulnerability on the particular network asset.