Tuesday, May 5, 2026
Managing vulnerabilities in embedded systems and the IoT using AI: dream or reality?
Managing system vulnerabilities has become essential in the embedded systems and IoT sectors; first and foremost to ensure the security of products and users, but also to comply with regulatory cybersecurity requirements, such as the European Cyber Resilience Act. What if AI could save time on this sometimes tedious work? After all, wouldn’t that be the secret dream of many R&D teams?
AI: a solution to speed up vulnerability analysis?
Great prospects
We can already envisage the benefits of using AI for this type of maintenance:
Time savings: Chatbots based on large language models such as ChatGPT or Copilot will enable the identification of trends and anomalies that might be missed during a manual analysis of long lists of vulnerabilities. They automate data analysis and deliver results in real time, which can save development teams a significant amount of time.
Cost reduction: AI-powered automated assessment reduces the human effort required. The result: fewer resources need to be allocated to identifying and resolving vulnerabilities, freeing up time for higher-value-added tasks, such as application development.
Specific benefits at each stage of the CVE lifecycle
Vulnerability management is divided into three main phases, in which AI can play different roles:
Detection: AI can prove invaluable in the first phase, detecting vulnerabilities from an SBOM (Software Bill of Materials, i.e. a list of software packages) fed into an LLM (Large Language Model, i.e. a linguistic model with a very large number of parameters based on neural networks). This can identify critical CVEs (Common Vulnerabilities and Exposures) applicable to your embedded system.
Assessment: AI can also prove useful during phase 2 by providing information on the detected CVEs and simplifying the assessment of their impact and relevance to your product, notably by offering a highly effective natural language interface that allows you to ‘discuss’ a CVE and its applicability by incorporating a broader context based on internet searches.
Remediation: Fixing vulnerabilities mainly involves human intervention, for the application of patches or updates, and AI does not yet play a role in this process.
See this article for more details on vulnerability lifecycle management.
What research tells us
The use of LLMs for vulnerability management is still in its infancy, and research findings on this topic remain limited. One of the few studies on the subject comes from Siemens Healthcare. In 2025, their teams created their own LLM, trained using their databases containing years of manual vulnerability analyses on their systems. This internal model was used to assess CVEs whilst remaining under the supervision of a cybersecurity expert, to ensure the reliability of the results. This experiment identified several recurring limitations of AI:
Hallucinations: AI can sometimes omit or invent information essential for analysing, resolving or communicating about vulnerabilities (such as the software versions concerned, patch recommendations or the names of affected components).
Off-topic text: Language models often generate useless or irrelevant content, which complicates the reading and validation of CVEs.
Difficulty with long texts: Processing long lists of vulnerabilities remains complex for AI. A better approach is to break the text down and apply a detailed analysis to each case.
The study conducted at Siemens Healthcare showed that an in-house AI model, properly trained on a vast historical dataset, can effectively help cybersecurity specialists to quickly identify significant vulnerabilities and relay the relevant information to stakeholders. However, despite these benefits, AI alone is not sufficient to manage the entire vulnerability lifecycle in IoT systems or ensure regulatory compliance in cybersecurity. Why public LLMs are not (yet?) ready In this section, we will focus on public LLMs – AI models accessible to the general public, such as OpenAI’s GPT-5 – as opposed to in-house models built and trained specifically by an organisation (such as the one from Siemens Healthcare discussed earlier) for private and business use.
The risk of missing a critical CVE
Although AI can help identify vulnerabilities, there is no guarantee that a significant flaw will not be overlooked. In reality, no tool can do so, as detection depends largely on the disclosure of vulnerabilities within the community, and some will inevitably remain unknown. It is therefore essential not to rely solely on AI for this type of analysis, particularly when seeking compliance with the Cyber Resilience Act (CRA), which requires both thoroughness and responsiveness: any exploitable vulnerability in a product must be identified quickly, validated, reported to the authorities, and then, where necessary, rectified via a product update.
The risk of sensitive data disclosure
The use of AI in cybersecurity raises ethical and privacy concerns. CVEs are directly linked to your products, and transmitting this data to external services such as ChatGPT, Copilot or others risks seeing sensitive data redistributed outside your organisation. Such incidents have already occurred: ChatGPT has, in the past, disclosed confidential information that should never have been disclosed…
Integration challenges in DevOps processes
Integrating AI into your pipeline or vulnerability management tools can be complex. Challenges in interoperability, different data structures and the need to fine-tune each tool can be real barriers to adoption.
Examples of analysis generated by ChatGPT
Here are two examples of analyses generated by ChatGPT around a Linux vulnerability identified in an IoT product:
Generating a list of CVEs applicable to a Linux kernel
Request for information on CVE-2023-4622
In the context of these analyses, it can be noted that ChatGPT has no added value compared to other non-AI-based tools in producing a list of applicable CVEs (omission of many important vulnerabilities, false positives, errors). On the other hand, the second example highlights the usefulness of such a tool for the analysis of a given vulnerability, by making it possible to accelerate the search for information as well as the diagnosis on a given product via the possibility of enriching its context with additional technical information such as git logs, configuration information, etc.
However, these results should not be taken for granted and judgment should be exercised: any technical parameter leading to the validation or non-validation of a vulnerability and its mitigation must be confirmed by hand, in order to guard against possible hallucinations and incompleteness. So, AI or not AI to manage vulnerabilities of embedded systems? It now appears that artificial intelligence is not sufficiently mature to cover the entire lifecycle of vulnerabilities in embedded and IoT systems. Although LLMs can provide ad hoc assistance, particularly for the analysis and qualification of a specific CVE, it remains essential to rely on reliable sources in order to ensure the quality of information and limit the risks of leakage of sensitive data. The use of an internal AI is an interesting avenue to strengthen security, since it would then allow to keep control over confidential data. However, this approach requires extensive technical adaptation and resources to precisely meet your organization's needs. Finally, specialized tools, such as CVEScan from The Embedded Kit, now offer a robust alternative. Leveraging the public foundation of CVE and advanced filters, CVEScan makes it easy to identify, analyze, and track vulnerabilities while minimizing false positives. Even without AI, this solution saves time and optimizes risk management for embedded systems.
Meet the Embedded Kit team at Lyon Cyber Expo and SIDO on booth O208.