# Contextualization of Third-Party Cloud Security Findings

arXiv: https://arxiv.org/abs/2610.08895 · HTML: https://mlsanity.com/paper/2610.08895/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 17 of its 61 references that are in the map.
- First posted on arXiv 6 Oct 2026.

## Builds on (most cited first, 17 of 17)

- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generation](https://mlsanity.com/paper/2305.14251/) (2023)
- [Deep Research Agents: A Systematic Examination And Roadmap](https://mlsanity.com/paper/2506.18096/) (2025)
- [Prompting the Priorities: A First Look at Evaluating LLMs for Vulnerability Triage and Prioritization](https://mlsanity.com/paper/2510.18508/) (2025)
- [SastBench: A Benchmark for Testing Agentic SAST Triage](https://mlsanity.com/paper/2601.02941/) (2026)
- [KubeGuard: LLM-Assisted Kubernetes Hardening via Configuration Files and Runtime Logs Analysis](https://mlsanity.com/paper/2509.04191/) (2025)
- [AI Native Asset Intelligence](https://mlsanity.com/paper/2605.09115/) (2026)
- [Cross-Vendor Sola ISPM Benchmark: Evaluating Agentic AI for Federated Identity Security Reasoning](https://mlsanity.com/paper/2606.02674/) (2026)
- [Does Runtime Topology Context Improve LLM-Generated Kubernetes Security Patches?](https://mlsanity.com/paper/2607.25995/) (2026)
- [A Non-Intrusive and Context-Based Vulnerability Scoring Framework for Cloud Services](https://mlsanity.com/paper/1611.07383/) (2016)
- [Reducing False Positives with Active Behavioral Analysis for Cloud Security](https://mlsanity.com/paper/2508.12584/) (2025)
- [Precision over Noise: Tailoring S3 Public Access Detection to Reduce False Positives in Cloud Security Platforms](https://mlsanity.com/paper/2508.14402/) (2025)
- [From Description to Score: Can LLMs Quantify Vulnerabilities?](https://mlsanity.com/paper/2512.06781/) (2025)
- [JAF: Judge Agent Forest](https://mlsanity.com/paper/2601.22269/) (2026)
- [Adaptive Incident Prioritization for Security Operations at Scale](https://mlsanity.com/paper/2607.16963/) (2026)
- [VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities](https://mlsanity.com/paper/2609.08040/) (2026)
- [Coding Agents Aren't Enough! Evaluating an Enterprise Security Brain for Agentic Cloud Investigations](https://mlsanity.com/paper/2609.30345/) (2026)

## Abstract (arXiv)

Finding severity is the main driver of how security teams prioritize remediation. For third-party cloud security findings, that severity is static: the rule that raised the finding assigns it before the rule meets any environment, so it reflects the risk of the condition in general rather than the risk the finding poses to the concrete environment where it lives. Scoring standards define where environment-specific context belongs. How far that context changes finding severities in production, where the deciding evidence lies, and whether it holds against the live environment have not been measured. We address this gap with contextualization, re-deriving each finding's severity from evidence in the environment where the finding lives. A deep research agent over a precomputed cross-signal asset graph investigates each finding against the resource's state, its graph neighborhood, and other products' signals, and returns an adjusted severity with an evidence trace. We evaluate it in a production field study of 9,967 vendor HIGH findings from two commercial cloud security platforms across eight real production environments, on three criteria: the faithfulness of the facts behind each verdict to the live environment, the dependence of each decision on context beyond the flagged resource, and the regularity of the reasoning. Three in four findings are re-graded, mostly downward, and the same rule often moves in opposite directions inside a single environment. About half of the decisive evidence lies beyond the flagged resource, and read-only probes of live infrastructure confirm the decisive fact for 99.4% of decided findings.