AI & LLM Engine
apPosture uses AI heavily - but with hard boundaries set in code. The model guides search and explains risk; deterministic logic decides verdicts. The result: AI value without AI hallucination, and it runs fully offline.
Local, offline by default
- The LLM is self-hosted on a local runtime - no data leaves your infrastructure, no external API, works air-gapped.
- Provider-neutral config (
llm_url/llm_model) - point it at another local or hosted model if you prefer.
Where AI is used
| Capability | What the AI does | The guardrail |
|---|---|---|
| Autonomous Pentest | Chooses the next payload from the response. | A deterministic adjudicator (marker/timing/canary) gives the verdict. |
| Triage copilot | Explains a finding, business impact, fix. | Claims are dropped unless cited; sensitive data is masked. |
| NL query (Ask AI) | Turns a question into a query. | The LLM never writes SQL - NL maps to whitelisted intents. |
| Threat models | Reconstructs architecture + STRIDE threats. | "Proven" requires a real DAST finding; IaC is parsed, not guessed. |
| Fix suggestions | Proposes a patch / PR diff. | Closed-loop validated; presented as a suggestion. |
| Briefings / risk intel | Summaries, $-exposure, attacker view. | Deterministic data underneath; AI is the narration. |
The honesty bar
This is a security tool, so the AI is held to the engine's quality bar:
- Evidence over heuristics - a finding needs proof; a threat is "proven" only with a confirmed finding behind it.
- No over-claim - reachable ≠ proven; parser-confirmed ≠ RCE. Confidence is labelled (proven / likely / inferred).
- Deterministic fallback - with the model unavailable, pure-rule paths still work (gates, rule engine, IaC parsing) - nothing hard-depends on the LLM.
- Full audit - AI-driven actions are logged; model drift can't silently change a verdict.
Performance notes
The local model is the bottleneck on CPU-only hosts. apPosture tunes for it (keep-alive, severity-scoped analysis, trimmed agentic loops); a GPU host unlocks deeper, faster analysis. See Installation.