Keeping up with cybersecurity developments is an ongoing challenge for IT departments. Every week, numerous vulnerabilities, security patches and exploitation reports are published across different platforms. However, not every critical advisory is relevant to the technologies an organisation actually uses.

Building on our earlier AI-focused cybersecurity monitoring initiative, the AI Learning Centre (AILC) is developing a more specialised cybersecurity intelligence workflow in collaboration with the University of Nicosia's IT Department. The aim is to transform large volumes of security reporting into a focused weekly briefing highlighting developments that may require attention.

Designed as an AI-powered agentic automation workflow, the system coordinates cybersecurity monitoring, information processing and intelligent analysis across multiple stages. It gathers advisories from trusted sources, including CISA, CERT-EU, AWS, GitHub Security Advisories and official software vendor publications. Collected information is stored in structured data tables and compared against UNIC's technology inventory, allowing the workflow to identify potentially relevant security issues across the University's systems and services.

At the core of the workflow is a two-stage AI analysis process. The first stage examines individual articles, identifying affected technologies, vulnerabilities, potential exploitation and applicability to UNIC. The second stage groups related reports, removes repetitive coverage and ranks security developments using criteria such as institutional relevance, security impact, exploitation evidence, actionability and timeliness.

The selected developments are then assembled into a professionally formatted cybersecurity briefing, featuring a priority overview, concise explanations, affected technologies, recommended actions, CVE references and links to original sources.

During initial testing, the workflow processed a collection of 63 cybersecurity articles, identified 40 potentially relevant candidates, and consolidated the results into 9 distinct security developments, supported by 23 original source articles.

Importantly, the workflow distinguishes potential relevance from confirmed exposure. An advisory matching a technology in UNIC's inventory does not necessarily mean that a vulnerable version is deployed. The resulting briefings are therefore designed to support IT awareness and prioritisation, rather than replace vulnerability assessment or security decision-making.

As development continues, the goal is to establish a reliable, repeatable monitoring process that reduces manual information filtering and helps UNIC IT focus on the cybersecurity developments most relevant to its infrastructure.

Click here to view the output