Cybersecurity components communicating and cooperating with one or more large language models

1 . A cybersecurity system, comprising:

one or more cybersecurity components including

i) a cyber security appliance with a cyber threat detect engine to detect a cyber threat in one or more of an email system, an Information Technology network, a cloud network, and any combination thereof,

ii) a proactive threat notification service to publicize new and ongoing cyber threats,

iii) a cyber threat autonomous response engine to take one or more actions to mitigate a detected cyber threat,

iv) a cyberattack simulator to simulate a cyberattack,

v) a cyber-attack restoration engine to restore network components back to an operational state prior to the cyberattack, and

vi) an artificial intelligence-based cyber threat analyst module to investigate a chain of two or more anomalies linked to each other over a time frame of examination spanning two or more days;

one or more large language models (LLMs) implemented with 1) electronic circuit, 2) as software stored in one or more non-transitory computer storage mediums and executed by one or more processors, or 3) any combination thereof, and configured to communicate and cooperate with the one or more cybersecurity components via one or more Application Program Interfaces (APIs) to receive cyber security information being produced by the one or more of the cybersecurity components and then to apply language generation functionality in order to assist a human in an understanding of the cyber security information being produced by the cybersecurity components, and then also to provide recommendations to prioritize breaches over other breaches in a native human friendly format for the human;

where instructions implemented in software for the cybersecurity components and the large language models are configured to be stored in one or more non-transitory storage mediums to be executed by one or more processing units, and

where the one or more LLMs are trained to do tasks on behalf of a user and provide human readable summaries, including

i) summarization and prioritization of breaches,

ii) launching an investigation using the one or more APIs to find out information, and then

iii) utilizing language capabilities of the LLMs to rephrase existing textual material to make the information more readily understandable to a larger audience of human end users.

2 . The cybersecurity system of claim 1 , comprising:

where a first LLM has been trained on an API specification for one or more of the cyber security components so that the first LLM of the one or more LLMs can understand how to make API requests and translate at least one of i) a user question and ii) a question by the LLM itself into API queries into the one or more cyber security components of the cyber security system to explain a decision process of a machine learning from within that cyber security component as well as explain a cyber security incident in the native human friendly format for that human.

3 . The cybersecurity system of claim 1 , comprising:

where a first LLM has been trained on an API specification for one or more of the cyber security components so that the first LLM of the one or more LLMs can understand how to make API requests to help explain both i) a decision-making process of one or more of the cyber security components as well as ii) cyber security jargon and concepts to enhance transparency and trust.

4 . The cybersecurity system of claim 1 , comprising:

where a first LLM has been trained on an API specification for one or more of the cyber security components so that the first LLM of the one or more LLMs can understand how to make API requests, where the training also included training on capabilities of each of the one or more of the cybersecurity components including what type of information can be found by communicating with each particular cybersecurity component as well as how to get that information through an API request.

5 . The cybersecurity system of claim 1 , comprising:

where a first LLM has been trained to take in a specification description of one or more of the APIs and turn the specification of one or more of the APIs into a set of endpoints and their associated parameters and available information that a trained deep learning model in the LLM will then use to call the cybersecurity components.

6 . The cybersecurity system of claim 1 , comprising:

where a first LLM has been trained to perform an automatic translation of the cyber security information in a first human language into a second human language of content within a user interface to be displayed on a display screen.

7 . The cybersecurity system of claim 1 , comprising:

where a first LLM has a query interface, where the first LLM of the one or more LLMs with its training on the cyber security information combined with its training to go through the APIs to obtain additional knowledge from the cyber security components creates a large cyber security knowledge base that allows the first LLM of the one or more LLMs to act as a search engine, in response to a user's query to the query interface, to obtain and provide detailed understandings of the cyber security information.

8 . The cybersecurity system of claim 1 , comprising:

where a first LLM has a user interface, where an end user is able to select at least one of a term and a phrase, displayed on the user interface, as a query input to the first LLM of the one or more LLMs in order to cause the first LLM of the one or more LLMs to explain and provide additional details on the selected term and/or phrase.

9 . The cybersecurity system of claim 1 , comprising:

where one or more of the cybersecurity components, which are configured to provide a list of all of the breaches and their severity scores as well as cyber threats trending currently in response to a first API request, to a first LLM of the one or more LLMs, and then the first LLM of the one or more LLMs is trained to provide the recommendations to prioritize the breaches over other breaches i) on a display and/or ii) in a printed report to the human.

10 . A method to protect against cyber threats, comprising:

providing one or more cybersecurity components including

i) a cyber security appliance with a cyber threat detect engine to detect a cyber threat in one or more of an email system, an Information Technology network, a cloud network, and any combination thereof,

ii) a proactive threat notification service to publicize new and ongoing cyber threats,

iii) a cyber threat autonomous response engine to take one or more actions to mitigate a detected cyber threat,

iv) a cyberattack simulator to simulate a cyberattack,

v) a cyber-attack restoration engine to restore network components back to an operational state prior to the cyberattack, and

vi) an artificial intelligence-based cyber threat analyst module to investigate a chain of two or more anomalies linked to each other over a time frame of examination spanning two or more days;

providing one or more large language models (LLMs) to communicate and cooperate with the one or more cybersecurity components via one or more Application Program Interfaces (APIs) to receive cyber security information being produced by the one or more of the cybersecurity components and then to apply language generation functionality in order to assist a human in an understanding of the cyber security information being produced by the cybersecurity components, and then also to provide recommendations to prioritize breaches over other breaches in a native human friendly format for the human; and

providing the one or more LLMs that are trained to do tasks on behalf of a user and provide human readable summaries, including

i) summarization and prioritization of breaches,

ii) launching an investigation using the one or more APIs to find out information, and then

iii) utilizing language capabilities of the LLMs to rephrase existing textual material to make the information more readily understandable to a larger audience of human end users.

11 . The method of claim 10 , comprising:

providing a first LLM that has been trained on an API specification for one or more of the cyber security components so that the first LLM of the one or more LLMs can understand how to make API requests and translate at least one of i) a user question and ii) a question by the LLM itself into API queries into the one or more cyber security components of the cyber security system to explain a decision process of a machine learning from within that cyber security component as well as explain a cyber security incident in the native human friendly format for that human.

12 . The method of claim 10 , comprising:

providing a first LLM that has been trained on an API specification for one or more of the cyber security components so that the first LLM of the one or more LLMs can understand how to make API requests to help explain both i) a decision-making process of one or more of the cyber security components as well as ii) cyber security jargon and concepts to enhance transparency and trust.

13 . The method of claim 10 , comprising:

providing a first LLM that has been trained on an API specification for one or more of the cyber security components so that the first LLM of the one or more LLMs can understand how to make API requests, where the training also included training on capabilities of each of the one or more of the cybersecurity components including what type of information can be found by communicating with each particular cybersecurity component as well as how to get that information through an API request.

14 . The method of claim 10 , comprising:

providing a first LLM that has been trained to take in a specification description of one or more of the APIs and turn the specification of one or more of the APIs into a set of endpoints and their associated parameters and available information that a trained deep learning model in the LLM will then use to call the cybersecurity components.

15 . The method of claim 10 , comprising:

providing a first LLM that has a query interface, where the first LLM of the one or more LLMs with its training on the cyber security information combined with its training to go through the APIs to obtain additional knowledge from the cyber security components creates a large cyber security knowledge base that allows the first LLM of the one or more LLMs to act as a search engine, in response to a user's query to the query interface, to obtain and provide detailed understandings of the cyber security information.

16 . The method of claim 10 , comprising:

providing a first LLM that has a user interface, where an end user is able to select at least one of a term and a phrase, displayed on the user interface, as a query input to the first LLM of the one or more LLMs in order to cause the first LLM of the one or more LLMs to explain and provide additional details on the selected term and/or phrase.

17 . The method of claim 10 , comprising:

providing one or more of the cybersecurity components, which are configured to provide a list of all of the breaches and their severity scores as well as cyber threats trending currently in response to a first API request, to a first LLM, and then the first LLM of the one or more LLMs is trained to provide the recommendations to prioritize the breaches over other breaches i) on a display and/or ii) in a printed report to the human.

18 . A non-transitory storage medium including software that, upon execution by a processor, is configured to perform operations, comprising:

using one or more large language models (LLMs) to communicate and cooperate with one or more cybersecurity components via one or more Application Program Interfaces (APIs) to receive cyber security information being produced by the one or more of the cybersecurity components and then to apply language generation functionality in order to assist a human in an understanding of the cyber security information being produced by the cybersecurity components, and then also to provide recommendations to prioritize breaches over other breaches in a native human friendly format for the human, and

where the one or more cybersecurity components configured to cooperate with the LLMs include

i) a cyber security appliance with a cyber threat detect engine to detect a cyber threat in one or more of an email system, an Information Technology network, a cloud network, and any combination thereof,

ii) a proactive threat notification service to publicize new and ongoing cyber threats,

iii) a cyber threat autonomous response engine to take one or more actions to mitigate a detected cyber threat,

iv) a cyberattack simulator to simulate a cyberattack,

v) a cyber-attack restoration engine to restore network components back to an operational state prior to the cyberattack, and

vi) an artificial intelligence-based cyber threat analyst module to investigate a chain of two or more anomalies linked to each other over a time frame of examination spanning two or more days; and

wherein the one or more LLMs are trained to do tasks on behalf of a user and provide human readable summaries, including i) summarization and prioritization of breaches, ii) launching an investigation using the one or more APIs to find out information, and then iii) utilizing language capabilities of the LLMs to rephrase existing textual material to make the information more readily understandable to a larger audience of human end users.