AI-Driven Security Posture Management Platform

linkedin · Tech · 2024 · source Agentic: no · promotional bias: low · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Enterprise security posture management

LinkedIn security teams needed fast ad hoc answers over distributed security data, but existing UI, GraphQL, and APIs were not enough for analysts and system owners.

Constraints:

• distributed security systems
• knowledge graph complexity
• low-latency queries
• hallucination risk

Architecture

LinkedIn SPP AI routes natural-language security questions through context generation, embeddings, query routing, graph or GraphQL backends, and answer summarization, with human validation to manage hallucination risk.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  user-query-interface["User query interface"]
  context-generation["Context generation"]
  embedding-and-indexing["Embedding and indexing"]
  query-routing["Query routing"]
  security-knowledge-graph["Security Knowledge Graph"]
  graphql-backend["GraphQL backend"]
  response-summarizer["Response summarizer"]
  human-validation["Human validation"]
  user-query-interface --> context-generation
  context-generation --> embedding-and-indexing
  context-generation --> query-routing
  embedding-and-indexing --> query-routing
  query-routing --> security-knowledge-graph
  query-routing --> graphql-backend
  query-routing --> response-summarizer
  response-summarizer --> human-validation

Components

Data flow

A query is routed to the most efficient security knowledge graph or GraphQL backend, then summarized back to users rather than forcing all security data into one aggregate store.

Why this architecture

The architecture exists because the original UI, GraphQL, and APIs were not enough for users who needed fast ad hoc answers across security data.

Models used: Davinci · GPT-4 · private Azure OpenAI models

Scale

• Early results reported about 150% faster vulnerability response and 155% more digital-infrastructure coverage.
  “Early results show that SPP minimizes manual intervention, enhancing the speed of our vulnerability response by ~150%, increasing our coverage of our digital infrastructure by ~155%”article, stated
• LinkedIn reported roughly 150% faster vulnerability response and about 155% more digital-infrastructure coverage.
  “Early results show that SPP minimizes manual intervention, enhancing the speed of our vulnerability response by ~150%, increasing our coverage of our digital infrastructure by ~155%”article, stated
• Security answers must cover multiple data stores without forcing all data into one aggregate backend first.
  “Query routing directs to the most efficient knowledge graph or GraphQL backend. The architecture supports more data backends, allowing questions to be asked from various data stores without aggregating all the data first.”article, stated

Alternatives considered (roads not taken)

Single aggregated security datastore for all questions

Rejected because: The team kept multiple backends and query routing so different data stores could answer questions without centralizing everything first.

The original UI, GraphQL, and APIs as the only access path

Rejected because: Those tools were not enough for analysts and system owners seeking fast ad hoc answers.

Assuming hallucinations can be fully eliminated by prompt refinement alone

Rejected because: LinkedIn reduced hallucinations but explicitly records eliminating them entirely as ongoing work.

Patterns

rag-retrieval (security)

The assistant retrieves and summarizes security-knowledge-graph data so analysts can ask natural-language questions over infrastructure risk.

human-in-the-loop-gate (quality)

Human experts validate a subset of outputs to ensure generated answers are accurate and understandable for security users.

Tradeoffs

How to keep query answers fast and accurate across multiple backends.

Chose query routing to the most efficient graph or GraphQL backend over aggregating all data into one monolithic store first.

Rationale: Routing preserves backend flexibility and latency while allowing questions across more data stores.

Gotchas (what bit them)

The original security tools did not meet users' need for fast ad hoc answers.

Root cause: Security analysts and system owners needed natural-language access across complex distributed security data, not just UI, GraphQL, and APIs.

Resolution: Add an LLM interface over the security knowledge graph with context generation, routing, summarization, and validation.

Evaluation

LinkedIn used automated and human validation while tuning context, prompts, and model generations to reduce hallucinations and improve answer quality.

Metrics: 40-50% early accuracy · 85-90% GPT-4 accuracy · 150% vulnerability response speed improvement · 155% infrastructure coverage increase

Outcomes

• SPP AI improved vulnerability response speed and infrastructure coverage.
• The system made data-driven security decisions more accessible to analysts and system owners.

LinkedIn engineering/social post; outcome percentages are company-reported and definitions are not fully specified.