{"resourceId":"unic-agentic-cybersecurity-advisory-triage-workflow-test-20261030","versions":[{"version":"external-fe64c47487322ad5c586dc5463a914a6e770d17cc7b39eb5a9d8be34a65e430d","resource":{"id":"unic-agentic-cybersecurity-advisory-triage-workflow-test-20261030","title":"University of Nicosia tests an agentic workflow that filters 63 security advisories down to 9 developments matched to its technology inventory","organization":"University of Nicosia","sector":"Higher education IT security operations","geography":"Cyprus","publishedAt":"30 October 2026 (UNIC AI Learning Centre blog)","publicationDate":"2026-10-30","eventDate":"2026-10-30","sourceName":"University of Nicosia AI Learning Centre","sourceLabel":"University AI centre project post","sourceUrl":"https://www.unic.ac.cy/ai-lc/2026/10/30/building-a-technology-aware-cybersecurity-intelligence-workflow-for-unic-it/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","data-security","infrastructure","knowledge-work"],"finding":"UNIC's AI Learning Centre and IT department are building an agentic workflow that collects security advisories from sources such as CISA, CERT-EU and GitHub, compares them with UNIC's technology inventory and produces a ranked weekly briefing. In initial testing it processed 63 articles, flagged 40 potentially relevant candidates and consolidated them into 9 developments supported by 23 source articles. The team says a match does not confirm exposure, and the briefing supports prioritisation rather than replacing vulnerability assessment.","sledRelevance":"A concrete campus IT security use of agents, with stated limits. Transferability to U.S. campuses depends on having a current technology inventory; the test does not show time saved or missed advisories.","evidence":"Operator self-report of one initial test; counts are stated but accuracy against analyst review is not reported.","architectureImplications":"Multi-stage agentic pipeline with structured data tables and inventory matching.","governanceImplications":"Output is advisory; security decisions stay with IT staff.","securityPrivacyImplications":"Relies on an accurate inventory; potential relevance is not confirmed exposure.","caveats":"Self-reported; single test; no accuracy, recall or time-saved data; Cyprus context.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: UNIC shows a campus IT team using agents to cut advisory reading from 63 articles to 9 ranked items. Interpretation: CISOs at under-staffed campuses may want help piloting a similar triage workflow tied to their asset inventory. A bounded engagement is an advisory triage pilot with analyst comparison. Do not claim time savings or better detection; UNIC reports counts from one test, not measured outcomes.","engineering":"Engineering framing: the workflow gathers advisories, stores them in tables, matches them to a technology inventory and runs a two-stage AI ranking. Interpretation: pre-sales should ask how current the asset inventory is, which model is used, and how missed advisories would be detected. UNIC itself notes that a match does not confirm a vulnerable version is deployed, so version-level inventory is a prerequisite.","delivery":"Delivery framing: UNIC positions the briefing as support for awareness and prioritisation, not a replacement for vulnerability assessment. Interpretation: delivery teams should run the workflow alongside analyst triage for several weeks, record misses and false positives, and set a review owner for each briefing. Acceptance should be measured recall against analyst review, which UNIC has not reported."},"roleDetails":{"sales":{"customerProblem":"Campus IT security teams cannot read every advisory relevant to their systems.","stakeholders":["CISO","IT operations lead","Security analysts"],"discoveryQuestions":["How current is the asset inventory?","How many advisories are reviewed weekly now?","Who acts on each briefing?"],"valueHypothesis":"Inventory-matched triage may reduce manual filtering; time saved is not measured here.","potentialEngagement":"A bounded advisory triage pilot compared with analyst review.","unsupportedClaims":["Time savings","Detection improvement","Reduced risk"]},"engineering":{"fit":"Campuses with a maintained technology inventory.","architectureIntegration":"Advisory collection, structured tables, inventory matching and two-stage AI ranking into a briefing.","prerequisites":["Version-level asset inventory","Feed access to CISA, CERT-EU and vendor advisories"],"constraints":["Match does not confirm exposure","Model and hosting not stated"],"security":"Briefing is advisory only; vulnerability assessment remains separate.","proofOfValue":["Measure recall against analyst triage","Track false positives over several weeks"]},"delivery":{"work":"Run the triage workflow in parallel with analyst review.","dependencies":["Asset inventory owners","Security analysts","AI centre developers"],"ownership":"University IT security, with the AI centre as builder.","skillsAdoption":"Analysts trained to review and correct briefings.","governanceCheckpoints":["Parallel run before reliance","Named reviewer per briefing","Quarterly accuracy review"],"acceptanceCriteria":["Proposed: no critical advisory missed in a parallel run","Proposed: weekly briefing delivered on schedule"],"risks":["Missed advisories","Stale inventory","Over-reliance on rankings"]}},"retrievedAt":"2026-11-02T08:34:12-06:00","enrichedAt":"2026-11-02T08:38:26-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Aims to reduce manual filtering for IT staff; no staffing change stated.","procurementImplications":"Built in-house by the university's AI centre; no vendor named.","operatingModelImplications":"AI centre builds; IT department consumes weekly briefings.","sourceVerification":{"openedUrl":"https://www.unic.ac.cy/ai-lc/2026/10/30/building-a-technology-aware-cybersecurity-intelligence-workflow-for-unic-it/","referenceExcerpt":"An advisory matching a technology in UNIC's inventory does not necessarily mean that a vulnerable version is deployed.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}