Accelerating Vulnerability Triage Across the Azure Network

No ratings

Presented at BlueHat IL 2026 by

Ido Frizler

Cloud-scale vulnerability triage is dominated by volume, ambiguity, and fast-changing infrastructure. In Microsoft Azure Networking, engineers must assess vulnerabilities across a diverse network fleet by correlating inconsistent free-text vendor advisories with internal inventory, device configurations, and live telemetry. Manual triage is slow, inconsistent, and toil-heavy, and often requires repeated re-triage as advisories and environments evolve. This talk presents NOVA (Network-agent Orchestrator for Vulnerability Analysis), a production system that automates end-to-end triage through deterministic, multi-agent orchestration inside Azure. NOVA coordinates 50+ task-specialized AI agents to interpret advisories, evaluate exploit conditions, map exposure to live environment data, and recommend mitigations. Instead of ad hoc prompting, NOVA enforces a deterministic, schema-validated workflow, while multi-agent refinement improves precision and reduces hallucinations. NOVA uses LLM inference to determine and explain vulnerability under specific exploit conditions — something brittle pattern-matching and queries can’t do reliably. NOVA synthesizes vendor PSIRTs, NVD updates, scanner outputs, internal inventory, historical triage records, configurations, and telemetry to generate a report that surfaces the key evidence engineers need: whether the issue applies, why, what is impacted, and what to do next. A continuous monitoring feed triggers (and re-triggers) triage when advisories change or new evidence appears. We share what it takes to operationalize agentic vulnerability triage in production, including measured results: >90% reduction in triage time and ~97% classification accuracy, plus approaches to measuring agent accuracy reliably in real-world deployments.