↓Skip to main content

Why I'm Building CVE Friday Brief

·3 mins
Table of Contents

Too many CVEs, too little time #

Last week, more than 800 new CVEs (security vulnerabilities) were published. Did anyone read them all? Of course not.

Most of them don’t matter for you. But a few of them matter a lot. The hard part is finding those few - every single week.

I am Bartlomiej, a DevOps engineer from Poland. I work with vulnerabilities and security tools every day, and I want to use this knowledge to learn something new: GenAI agents. So I am building a system that solves this problem for me.

This is my new project: CVE Friday Brief.

What Is CVE Friday Brief? #

The service works every day: it collects new CVE data from public sources and processes it in the background.

Then, every Friday, it generates one report - a short brief (for example, a PDF) with the most important CVEs of the week. For each one, the brief explains:

  • What is the vulnerability?
  • Why is it important right now?
  • A detection rule (Sigma or KQL), when detection is possible, so a security team can find it in their logs.

No long reports. Just the key facts, fast.

One entry in the brief could look like this (using the famous Log4Shell as an example):

CVE-2021-44228 - RCE in Apache Log4j, “Log4Shell” (CVSS 10.0)

  • Status: In the CISA KEV list.
  • Why now: Public exploits available, still used by attackers today.
  • Detection: Sigma rule - look for ${jndi: strings in web request logs.

How It Works #

I will not write this by hand every week. Instead, I will build a small team of AI agents:

  • One agent selects the most important CVEs from public sources like NIST NVD, CISA KEV, and EPSS.
  • One agent enriches each CVE with extra context, like public advisories.
  • One agent writes a detection rule for it.
  • One agent edits everything into one clean, short brief.

I will build this with Go, Google’s Agent Development Kit (ADK), and PostgreSQL.

My Goals #

I have two goals with this project:

  1. Build something useful, not just a demo.
  2. Learn GenAI multi-agent systems by doing, not just by reading about them.

This is a personal, open project. It is not connected to any company or product I work on - just me, building in public.

What’s Next #

In the next posts, I will explain:

  • What an AI agent really is, in simple words
  • My full pipeline, from raw data to a finished brief
  • When I use an agent, and when plain code is enough

Thanks for reading. If you want to follow this project, add the blog to your RSS reader or find me on LinkedIn - every step of the build will be documented here.