Skip to main content

AI & LLM Engine

apPosture uses AI heavily - but with hard boundaries set in code. The model guides search and explains risk; deterministic logic decides verdicts. The result: AI value without AI hallucination, and it runs fully offline.

Local, offline by default

  • The LLM is self-hosted on a local runtime - no data leaves your infrastructure, no external API, works air-gapped.
  • Provider-neutral config (llm_url / llm_model) - point it at another local or hosted model if you prefer.

Where AI is used

CapabilityWhat the AI doesThe guardrail
Autonomous PentestChooses the next payload from the response.A deterministic adjudicator (marker/timing/canary) gives the verdict.
Triage copilotExplains a finding, business impact, fix.Claims are dropped unless cited; sensitive data is masked.
NL query (Ask AI)Turns a question into a query.The LLM never writes SQL - NL maps to whitelisted intents.
Threat modelsReconstructs architecture + STRIDE threats."Proven" requires a real DAST finding; IaC is parsed, not guessed.
Fix suggestionsProposes a patch / PR diff.Closed-loop validated; presented as a suggestion.
Briefings / risk intelSummaries, $-exposure, attacker view.Deterministic data underneath; AI is the narration.

The honesty bar

This is a security tool, so the AI is held to the engine's quality bar:

  • Evidence over heuristics - a finding needs proof; a threat is "proven" only with a confirmed finding behind it.
  • No over-claim - reachable ≠ proven; parser-confirmed ≠ RCE. Confidence is labelled (proven / likely / inferred).
  • Deterministic fallback - with the model unavailable, pure-rule paths still work (gates, rule engine, IaC parsing) - nothing hard-depends on the LLM.
  • Full audit - AI-driven actions are logged; model drift can't silently change a verdict.

Performance notes

The local model is the bottleneck on CPU-only hosts. apPosture tunes for it (keep-alive, severity-scoped analysis, trimmed agentic loops); a GPU host unlocks deeper, faster analysis. See Installation.