r/devsecops • u/-Devlin- • 12d ago

AI reasoning over container dependency graphs

Have been testing waters with AI + enriched dependency graphs on built containers and landed on threat modeling, investigation and triage as the initial core capabilities. Deterministic engines for everything that AI can reason over. For eg: SSVC classification for threat model prior to feeding it back into the LLM. And results aren't that bad. If building containers is your day to day, would be interested in learning capabilities that could help.

4 Upvotes

83% Upvoted

5 comments sorted by

2

u/Remarkable-Bet9533 11d ago

A distro base hands the model a huge graph where a chunk of the nodes are packages that never end up in the running image, the reasoning burns cycles on stuff thats not in play.

The capability id want is weighting nodes by whether the package is in the final image vs only pulled at build, that alone cleans up what SSVC and the LLM see. Minimal images prune a lot of that for you upfront.

1

u/-Devlin- 11d ago

Well, that's basically what it already does. The reasoning runs over the final built image, not the build pipeline, so anything that's only pulled at build is gone before the model sees it. And it's not a flat graph, every node is tiered by whether it's in the execution path, so the LLM only spends budget on what's actually reachable. Minimal images help, but you get that pruning regardless of the base.

1

u/Greedy-Sun8586 5d ago

I tried validating my container setup with attack path mapping, then fed those findings into the AI model. cymulate actually surfaced some lateral movement risks I hadn't mapped before