Artificial intelligence for customized security shield deployment

A method comprising:

• receiving as input a description of a threat mitigation recommendation for addressing a security vulnerability;
• identifying a security policy applicable to the threat mitigation recommendation, the security policy identifying a set of metadata fields and a security rule template containing placeholders for entities referenced in an enterprise security graph;
• analyzing text of the threat mitigation recommendation to determine values for the set of metadata fields defined in the security policy;
• constructing one or more queries to the enterprise security graph that reference the values for the set of metadata fields to obtain, in response to the one or more queries, a set of entity identifiers corresponding to entities or resources of a specific network, the set of entity identifiers stored in the enterprise security graph in association with the values for the set of metadata fields;
• populating the security rule template with the set of entity identifiers obtained from the enterprise security graph in response to the one or more queries;
• deploying a customized security shield by executing code included in the security rule template, the code refencing the set of entity identifiers obtained from the enterprise security graph, wherein the customized security shield is a security rule or policy that protects specific devices identified by the set of entity identifiers from an attack exploiting the security vulnerability.

One or more tangible processor-readable storage media encoding processor-executable instructions for executing a computer process comprising:

• receiving, at a security intelligence model, a description of a security vulnerability, the security intelligence model trained on a corpus of textual data that includes descriptions of security vulnerabilities paired with threat mitigation actions identified as appropriate responses to the security vulnerabilities;
• generating, by the security intelligence model, a threat mitigation recommendation based on the description of the security vulnerability;
• based on an action type or cyberattack type identified within the threat mitigation recommendation, select a security policy applicable to the threat mitigation recommendation, the security policy identifying a set of metadata fields;
• analyzing text of the threat mitigation recommendation to determine a value for at least one metadata field of the set of metadata fields defined in the security policy;
• constructing a first query to an enterprise security graph to determine an entity identifier corresponding to an entity or resource of a specific network, the entity identifier stored in the enterprise security graph in association with the value for the at least one metadata field;
• defining a threat surface that includes the entity identifier;
• and
• deploying a security rule or policy that protects the threat surface from an attack exploiting the security vulnerability.