{
  "id": 2572234,
  "title": "Where the LLM Stops: Deterministic Scoring in an AI-Assisted VAPT Pipeline",
  "url": "https://urgent.news/2026/08/22/where-the-llm-stops-deterministic-scoring-in-an-ai-assisted-vapt",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-22T12:01:52.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/maverickaayush/where-the-llm-stops-deterministic-scoring-in-an-ai-assisted-vapt-pipeline-4jcd"
  },
  "original_language": "en",
  "account": "The latest open-source, self-hosted DAST (dynamic application security testing) platform, ONUS, tackles a crucial question in AI-assisted vulnerability assessment: should large language models (LLMs) shape or merely narrate the scoring of vulnerabilities? ONUS answers this by ensuring that every numeric score in the final report, including CVSS scores, CVSS vectors, severity levels, and priority ranks, is derived from a deterministic formula, not from the LLM. This core design objective guarantees that running the same scan multiple times will produce identical numbers, ensuring reproducibility and reliability. The ONUS test suite, comprising 690 tests, validates the CVSS scoring formula against known vectors, confirming that the model's output remains consistent regardless of prompts, model versions, or even its availability. ONUS achieves this by scoring vulnerabilities first and then having the LLM generate human-readable explanations. Furthermore, ONUS operates in an air-gapped mode, ensuring that no scan data leaves the local network, including the AI component, which runs locally on Ollama using Qwen 2.5 7B. This architecture eliminates the risk of an LLM downtime forcing a choice between blocking the report or using an untested scoring path, thus prioritizing accuracy and availability.",
  "summary": "Every VAPT report ends the same way: a handful of numbers. A CVSS score. A severity label. A priority rank. Sometimes an aggregate risk score. Those are the numbers a remediation team actually acts on: what gets patched this sprint, and what waits. Once a large language model enters that pipeline (writing summaries, explaining findings, drafting remediation steps), a quieter architectural…",
  "key_points": [
    "ONUS, open-source DAST platform, ensures deterministic scoring in AI-assisted VAPT pipeline",
    "CVSS scores, vectors, severity levels, and priority ranks derived from deterministic formula",
    "ONUS test suite validates CVSS scoring formula against known vectors for reproducibility"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}