How a grid operator stops treating security advisories as loose PDFs

Vendor bulletins, national CERT advisories, and internal incident reports arrive from a dozen directions, in a dozen formats. Each one, read on its own, is clear enough. What isn't clear without manual work is which of the operator's own assets, which substation, which control system, which vendor contract, a given advisory actually touches.

Analysts cross-reference by hand: read the advisory, check the asset inventory, check whether a similar issue came up before. Done for every bulletin, across every asset class, this doesn't scale to the volume that arrives in a given week. Triage becomes a judgement call about which advisories look serious enough to chase — a guess made under time pressure, with a thin record of why some were prioritised and others weren't.

KnowledgeHub ingests advisories, bulletins, the asset inventory, and prior incident reports as they arrive, preserving lineage at the document level. A versioned ontology models the relationships between assets, vendors, known vulnerabilities, and prior incidents.

When a new advisory comes in, agents are given a bounded task: match it against the asset inventory and incident history, and surface which systems are plausibly exposed, with the supporting evidence attached. The agent doesn't decide the response. An analyst confirms exposure — or rules it out — before anything is logged as an action.