Skip to content
FR

← WorkCETIC · NLP, GenAI and cybersecurity

RiskTailor: one risk report, one rendition per reader

A RAG pipeline behind an API that tailors a cyber-risk report summary to the architect, the manager or the compliance lead — published at INFORSID 2026, as first author.

Reader 01ArchitectVulnerabilities, exposed components
Reader 02ManagerImpacts and priorities
Reader 03ComplianceISO 27005 traceability
Role
R&D internship — first author of the paper
Period
01 — 03 · 2026
Status
Published research — INFORSID 2026
Tools
PythonFastAPIRAGEmbeddingsLLM

01Overview

A cyber-risk analysis report is dense and singular, but its readers are not: the architect looks for technical vulnerabilities, the manager for impacts and priorities, the compliance lead for traceability. Each rereads everything to find their part.

R&D internship at CETIC (Centre of Excellence in ICT, Charleroi), remote, within collective research on AI-generated risk reports. Risk-management methods used as the structuring frame: ITSRM, EBIOS, ISO 27005.

What I personally did

  • 01Built the NLP processing that identifies and organises the salient elements of reports (threats, vulnerabilities, impacts).
  • 02Experimented with language models, embeddings and contextual summary generation.
  • 03Implemented the FastAPI REST API: upload a report, choose the reader's profile, get a usable rendition.
  • 04First author of the paper presented at INFORSID 2026.

What isn't mine —The research is collective (CETIC). The paper's co-authors are Abiola Paterne Chokki and Jean-François Daune; the fine split of sub-modules belongs to internal deliverables.

02Constraints

  • Unstructured reports, terminology specific to each risk-management method.
  • One source, several faithful renditions: tailor without inventing.
  • A service other applications can use, not a notebook.

03Architecture

Source report

  1. §1 Context and scope
  2. §2 Identified threats
  3. §3 Technical vulnerabilities
  4. §4 Business impacts
  5. §5 Risk level and priorities
  6. §6 Measures and controls
  7. §7 Residual risk and traceability

Rendition · Architect

  • Vulnerabilities by component
  • Recommended technical fixes
  • Exposed dependencies
Conceptual view of the principle — not a real system output.
  1. 01

    Preprocessing

    Split and organise the report along the structure of risk methods.

  2. 02

    Retrieval

    Find, through embeddings, the passages relevant to the requested profile.

  3. 03

    Profile-aware generation

    Produce a summary grounded in those passages, at the reader's level of detail.

  4. 04

    API

    FastAPI exposes the flow: upload, profile, rendition.

Conceptual view — without internal model or metric details.

04Implementation decisions

  1. 01

    The reader profile as a first-class parameter

    The profile steers both passage retrieval and the summary's shape: we don't generate “a summary” and then rephrase it.

  2. 02

    Grounding the generation

    The summary relies on retrieved passages rather than the model's memory, to stay faithful to the source report.

05Challenges

Tailoring without distorting

The risk of a per-profile rendition is omitting or exaggerating. Grounding in passages and the structure of risk methods act as guardrails.

06Evaluation

The evaluation approach and its results are those of the INFORSID 2026 paper and CETIC deliverables.

Not publishedI don't reproduce models, scores or the API's deployment status here: they belong to the authorised deliverables.

07Outcomes

  • An NLP / RAG pipeline integrated into a backend application, exposed as an API.
  • Publication: “RiskTailor: Automatisation de la Personnalisation de Rapports de Risques Cybersécurité par Profil Utilisateur”, M. Abi, A. P. Chokki, J.-F. Daune — INFORSID 2026.

08What I took from it

  • 01Define the reader before the model: the useful output depends on who reads it.
  • 02Writing the paper forces you to separate what is shown from what is merely plausible.

09Evidence

Read next