AI Triage Assistant

• Overview
• Key Benefits
• How to Enable the Assistant
• Using the AI Triage Assistant
• Security and Data Privacy
• Frequently Asked Questions (FAQ)

Overview

The AI Triage Assistant is a secure, in-platform AI operational assistant designed to empower your security team. Embedded as a conversational chat interface within the Submission Inbox, the Assistant transforms vulnerability triage from a static checklist into a dynamic, conversational investigation. It allows analysts to ask questions, probe for details, and explore context in natural language - without leaving their primary triage workflow.

Key Benefits

• Accelerate Triage: Get instant summaries, payload explanations, and technical breakdowns to make faster, more informed decisions.
• Gain Deeper Insights: Go beyond the written report by asking for analysis on business impact or potential attack chains.
• Improve Operational Efficiency: Generate triage artifacts on demand, including remediation guidance and Nuclei templates for retesting.
• Work Securely: Unlike public AI tools, the Assistant operates entirely within the Bugcrowd platform. Your sensitive data is never exposed or used to train third-party models.

How to Enable the Assistant

The AI Triage Assistant is available as a program integration.

1. Navigate to the Integrations page in your program settings.
2. Locate the AI Triage Assistant card.
3. Select Enable to activate the Assistant for your security program.

Using the AI Triage Assistant

Once enabled, the Assistant is accessible to your team from within the Submission Inbox.

1. Accessing the Assistant Navigate to the Submission Inbox. The AI Triage Assistant appears as a chat interface in the bottom-right corner of the page.

2. The Interface:

• Chat Component: The Assistant lives in a chat window in the lower-right corner. Use the minimize icon to hide the chat or the expand icon to open it in full-screen mode.
• Suggested Prompts: When you open the chat, you’ll see one-click prompts for common triage tasks such as summarizing a submission or requesting remediation guidance.
• Text Input: A text input field at the bottom of the chat window allows you to type your own custom questions.
• New Chat: Select Delete to clear the current conversation. This is useful when starting a new topic or analysis.

3. Understanding Secure Context: The Assistant is context-aware and focuses on the submission you are currently viewing. When you open the Assistant on a submission, it automatically references submission details, comments, and engagement metadata (brief, targets, reward range) as secure context to inform responses. This ensures relevance and accuracy.

4. Example Prompts and Best Practices: Use natural language to interact with the Assistant. For deeper insights such as business impact, it helps to include additional context about your environment.

Summarize Submissions

• “Summarize this submission.”
• “Summarize the commentary on this submission.”

Explain Technical Concepts

• “Explain this payload and how it works.”
• “Explain this vulnerability to me as if I were a junior developer”
• “What is a ‘Time-of-check to time-of-use (TOCTOU)’ race condition?”

Assess Business Impact

• “What is the potential business impact of this submission?”
• “Explain the impact of this XSS vulnerability on a public-facing login page.”
• “Model a potential attack chain for this flaw.”

Accelerate Triage

• “Generate a valid Nuclei template for this submission.”
• “Suggest remediation guidance for this submission.”
• “Draft a comment asking the researcher for a video PoC.”

Security and Data Privacy

The AI Triage Assistant is designed with security and privacy as top priorities.

• Secure, Private Environment: All operations occur within the Bugcrowd platform, leveraging LLMs hosted in our secure Amazon Bedrock environment. Data is never exposed to the public internet or third-party models.
• No Third-Party Training: Your program data is never used to train AI models.
• Secure, Ephemeral Context: The Assistant uses submission-specific data only for the duration of a single query.
• Tenant Isolation: The Assistant has a zero-tolerance policy for cross-tenant data access. It cannot access any other program’s data.
• For more information, please reference Global Control of LLMs documentation

Frequently Asked Questions (FAQ)

Q: How is this different from a public tool like ChatGPT?
A: The AI Triage Assistant is secure and context-aware. It keeps your data private within the Bugcrowd platform and uses submission data to generate highly relevant analysis.

Q: Will the Assistant automatically change a submission’s status or priority?
A: No. The Assistant is a read-only analysis tool. It cannot change status, priority, or reward values.

Q: Can the Assistant see data from other Bugcrowd customers?
A: No. The Assistant can only access your program’s data, as permitted by your integration settings.

Q: Can I upload files like screenshots or logs for the Assistant to analyze?
A: No. The Assistant currently does not support file uploads. It analyzes the text and metadata already present in the submission.

Q: Can the Assistant analyze images or videos in the submission?
A: No. The AI Triage Assistant is text-based. It cannot interpret images, videos, or media files.

---