Where the LLM Stops: Deterministic Scoring in an AI-Assisted VAPT Pipeline
Every VAPT report ends the same way: a handful of numbers. A CVSS score. A severity label. A priority rank. Sometimes an aggregate risk score. Those are the numbers a remediation team actually acts on: what gets patched this sprint, and what waits. Once a large language model enters that pipeline (writing summaries, explaining findings, drafting remediation steps), a quieter architectural…
The latest open-source, self-hosted DAST (dynamic application security testing) platform, ONUS, tackles a crucial question in AI-assisted vulnerability assessment: should large language models (LLMs) shape or merely narrate the scoring of vulnerabilities? ONUS answers this by ensuring that every numeric score in the final report, including CVSS scores, CVSS vectors, severity levels, and priority ranks, is derived from a deterministic formula, not from the LLM.
This core design objective guarantees that running the same scan multiple times will produce identical numbers, ensuring reproducibility and reliability. The ONUS test suite, comprising 690 tests, validates the CVSS scoring formula against known vectors, confirming that the model's output remains consistent regardless of prompts, model versions, or even its availability.
ONUS achieves this by scoring vulnerabilities first and then having the LLM generate human-readable explanations. Furthermore, ONUS operates in an air-gapped mode, ensuring that no scan data leaves the local network, including the AI component, which runs locally on Ollama using Qwen 2.5 7B. This architecture eliminates the risk of an LLM downtime forcing a choice between blocking the report or using an untested scoring path, thus prioritizing accuracy and availability.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
