AI
Why Vulnerability Scanners Create a False Comfort Zone
“Our vulnerability scanner says we are clean.” Neacsu heard that sentence often enough that it bothers him. Scanners see the network perimeter. They miss stolen credentials — which accounted for 24% of initial entry vectors in the 2024 Verizon report — dark-web posts, leaked API keys, and exposed GitHub repos. They also lag: an attacker can develop an exploit faster than a scanner deploys a signature for a vulnerability released that morning.
“unseen means unsafe” — Catalin Neacsu
Not seeing a threat does not protect the organization from it.
No Intel / Griffin: Multi-Source Visibility Beyond the Network Perimeter
Griffin is Neacsu’s answer to that blind spot. The platform pulls from vulnerability scanning, deep and dark web monitoring, and GitHub repository exposure into a single interface — then makes it queryable. Two modes: conversational (RAG-backed, answers natural-language questions against vectorized findings) and structured (MCP client-server, selects the right API call, runs it, formats the result).
“having information isn’t necessarily the solution. The trick comes into making decisions” — Catalin Neacsu
That handoff — from collected signals to action — is where Griffin stops and Arcanna begins.
Arcanna AI: Decision Models That Replace LLM-Based Triage
Arcanna’s platform lets security analysts train their own deep neural networks directly on historical alert data. These are not LLMs. Analysts pick which fields in the alert body matter, label examples, and train until accuracy holds on new documents. The model Iakabos demonstrated hit 96% on unseen findings after training on 92 alerts.
“We did AI before ChatGPT was cool.” — Darius Iakabos
The design choice is intentional. LLMs are non-deterministic — the same input can produce different outputs. For triage, that variability is a liability. Arcanna’s neural networks produce a fixed decision: investigate, remediate, or archive. That prediction then triggers an agentic workflow, with LLMs handling reporting and data gathering downstream, where inconsistency costs less.
Griffin Live Demo: RAG Queries and MCP-Structured Lookups
Griffin’s chatbot runs two query modes. Conversational mode pulls from a RAG vector database: Neacsu asked what the biggest risk to his organization was, and the system came back with API key exposure. A follow-up question drilled into which hosts were leaking those keys. Griffin RAG query surfaces API key exposure (13:12)
Structured-data mode works differently. The LLM receives the question, picks the right internal API call from its MCP toolset, runs it, and formats the result. Griffin MCP structured query — asset lookup via API (14:33) The workflow trace panel shows each step: tool selection, API call, data retrieval, LLM interpretation. Neacsu noted LLMs are non-deterministic, which is exactly why Griffin separates information retrieval from decision-making.
Arcanna Live Demo: Automated Remediation and Investigation Workflows
Arcanna’s decision model was trained on 92 labeled alerts and reached 96% accuracy on new findings. Each prediction routes to one of three agentic workflows: remediate, investigate, or archive. Arcanna investigation workflow — Jenkins RCE confirmed from dark-web tip (19:11): a dark-web post naming a specific IP sent agents to cross-check asset records via MCP, confirm an exposed Jenkins console allowing remote code execution, and find secrets in a public GitHub repo on port 80. Arcanna remediation workflow — WAF rule auto-created for SQL injection (21:55): a scanner detecting an SQL error response triggered an automatic WAF rule with no human involved. A final agent writes an HTML report.
“decision making should be kept very strict” — Darius Iakabos
Q&A
Is it possible to connect Arcanna AI to a SIEM or SOAR for developing playbooks? Yes — SIEM and SOAR are Arcanna’s two primary data sources, and it integrates with most platforms so the model sits where the analyst already works. ▶ 25:47
How much training data and time does it take to reach 90% scenario coverage, and can threat-intel reports be ingested to speed that up? Time is not the constraint — data variety is: Arcanna takes six months of historical alerts, labels roughly a quarter of the unique ones (often 3,000 from a million raw alerts), iterates until accuracy hits 95%+, and yes, threat-intel inputs can be taken into account as decision points. ▶ 26:33
How do you ensure the RAG database has the right context so the chatbot doesn’t hallucinate? Arcanna’s decision models use no RAG at all; for Griffin (No Intel), static threshold rules — CVSS score, CVE severity, SQL injection flags — gate what enters the vector DB, and the LLM then selects the most relevant chunks for each query, with chunking overlap of at least 50% and headers/footnotes stripped. ▶ 31:08
Are you using LLMs out of the box, fine-tuned, and which models work best for cybersecurity tasks? Cloud frontier models (Claude latest, AWS Bedrock) work well out of the box with RAG and MCP; locally hosted open-source models like Llama 3 or GPT-OSS 120B need fine-tuning to be usable — no head-to-head ranking of specific models was given. ▶ 35:34
Does the decision model keep learning in production, and does bad prompting affect it long-term? The model does not self-update in production — new inputs are approximated to the nearest trained class — but the knowledge base can be corrected and the model retrained at any time, and a consensus mechanism flags labeling inconsistencies before they corrupt training. ▶ 37:29
Notable Quotes
our vulnerability scanner says we are clean Catalin Neacsu · ▶ 1:50
unseen means unsafe Catalin Neacsu · ▶ 4:38
We did AI before CH GPT was cool. Darius Iakabos · ▶ 9:15
having information isn’t necessarily the solution. The the the trick comes into making decisions Catalin Neacsu · ▶ 8:22
decision making should be kept very strict Darius Iakabos · ▶ 18:14
Key Takeaways
- Treat stolen credentials and dark-web exposure as part of attack surface, not just CVEs from network scans.
- Use deterministic decision models — not LLMs — for security triage where consistency and auditability matter.
- Automate detection-to-response end-to-end with agentic workflows; escalate to humans only when automation cannot act.
About the Speakers
Catalin Neacsu
Catalin Neacsu is a cybersecurity professional with 15+ years in cybersecurity across consulting, military/government, and large corporations. Core Expertise: SOC management, security monitoring, penetration testing, digital forensics, threat intelligence, strategic planning, GenAI security applications. Catalin leads comprehensive cybersecurity strategy development with a focus on integrating Agentic AI workflows into the core of security operations. Combines offensive and defensive security expertise to address complex challenges in cloud computing environments, pioneering the implementation of secure and effective AI-driven security solutions. Key Certifications: OSCP, GSTRT, GCFA, GREM, GNFA, CISSP, CEH, CompTIA Security+
Darius Iakabos
Lead Solutions Architect designing and deploying decision models and agentic workflows to enhance efficiency, scalability, and intelligence across modern Security Operations Centers (SOCs). Background in Cybersecurity Operations and automation.