VISOR: Automated Vulnerability Assessment of Software Repositories

Abstract

Modern software systems increasingly depend on open-source and commercial third-party components, which can expose them to cybersecurity risks present within these external dependencies. The vulnerability assessment of such components remains predominantly manual, creating bottlenecks that slow remediation efforts. This work introduces VISOR, an automated, LLM-driven framework that collects vulnerability information from various online sources and orchestrates the selection and invocation of multiple custom-designed vulnerability-assessment tools to generate structured and actionable reports for human experts. The framework supports two workflows: a linear agentic workflow that generates and then refines a well-parameterized tool plan, and a non-linear agentic workflow that adaptively revises the analysis through iterative refinement, dynamic tool selection, and evidence-guided adjustments. At its core, VISOR collects and correlates evidence to determine whether a reported vulnerability is applicable to a target software repository and whether the vulnerable code is reachable within the codebase. By design, the framework does not automatically apply mitigations to fix vulnerabilities; instead, it assists cybersecurity experts by providing evidence-based assessments and proposed mitigation actions in a structured report, enabling informed remediation decisions. Experiments show that the framework achieves 76% agreement with cybersecurity expert assessments while substantially reducing manual effort during initial vulnerability triage.