# A Systematic Approach to Predict the Impact of Cybersecurity Vulnerabilities Using LLMs

arXiv: https://arxiv.org/abs/2508.18439 · HTML: https://mlsanity.com/paper/2508.18439/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 31 references that are in the map.
- First posted on arXiv 25 Aug 2025.

## Builds on (most cited first, 6 of 6)

- [A Survey on In-context Learning](https://mlsanity.com/paper/2301.00234/) (2022)
- [Distributed Representations of Sentences and Documents](https://mlsanity.com/paper/1405.4053/) (2014)
- [Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach](https://mlsanity.com/paper/2108.01696/) (2021)
- [CVE-driven Attack Technique Prediction with Semantic Information Extraction and a Domain-specific Language Model](https://mlsanity.com/paper/2309.02785/) (2023)
- [Identification of Attack Paths Using Kill Chain and Attack Graphs](https://mlsanity.com/paper/2206.10272/) (2022)
- [Attack Techniques and Threat Identification for Vulnerabilities](https://mlsanity.com/paper/2206.11171/) (2022)

## Built on by (most cited first, 1 of 1)

- [SMSI: System Model Security Inference: Automated Threat Modeling for Cyber-Physical Systems](https://mlsanity.com/paper/2604.23905/) (2026)

## Abstract (arXiv)

Vulnerability databases, such as the National Vulnerability Database (NVD), offer detailed descriptions of Common Vulnerabilities and Exposures (CVEs), but often lack information on their real-world impact, such as the tactics, techniques, and procedures (TTPs) that adversaries may use to exploit the vulnerability. However, manually linking CVEs to their corresponding TTPs is a challenging and time-consuming task, and the high volume of new vulnerabilities published annually makes automated support desirable. This paper introduces TRIAGE, a two-pronged automated approach that uses Large Language Models (LLMs) to map CVEs to relevant techniques from the ATT&CK knowledge base. We first prompt an LLM with instructions based on MITRE's CVE Mapping Methodology to predict an initial list of techniques. This list is then combined with the results from a second LLM-based module that uses in-context learning to map a CVE to relevant techniques. This hybrid approach strategically combines rule-based reasoning with data-driven inference. Our evaluation reveals that in-context learning outperforms the individual mapping methods, and the hybrid approach improves recall of exploitation techniques. We also find that GPT-4o-mini performs better than Llama3.3-70B on this task. Overall, our results show that LLMs can be used to automatically predict the impact of cybersecurity vulnerabilities and TRIAGE makes the process of mapping CVEs to ATT&CK more efficient. A replication package is available for download from https://doi.org/10.5281/zenodo.17341503. Keywords: vulnerability impact, CVE, ATT&CK techniques, large language models, automated mapping.