KESE Vulnerability Auto-Fix
Generate and apply fixes based on vulnerability assessment results. Auto-selects guideline.
Guideline Selection
| # | Guideline | Description |
|---|---|---|
| 1 | CII Hardening | Platform-specific hardening scripts |
| 2 | AI Security Fixes | AI system security hardening |
| 3 | Robot Security Fixes | Robot system hardening (IEC 62443, CRA, RED) |
| 4 | Space Security Fixes | Space system hardening (CMMC, K-RMF, NIS2, NIST IR 8401) |
| 5 | Secure Coding Fixes | Auto-fix vulnerable code patterns (JS/Python, 46 CWE) |
| 6 | Zero Trust Fixes | Zero Trust gap remediation (8 elements, 4 maturity levels, ~396 items) |
| 7 | SW Supply Chain Fixes | SBOM generation, vulnerability scanning, remediation (29 items) |
Zero Trust, ZTA, ZTNA, 제로트러스트, 마이크로세그멘테이션, microsegmentation, SDP, SASE, PEP/PDP, never trust always verify → Zero Trust SBOM, supply chain, 공급망, C-SCRM, SCA, CycloneDX, SPDX, npm audit, pip-audit → SW Supply Chain
CII Branch
Load reference from templates/cii/ → generate hardening scripts saved to scripts/kese-hardening/. Check commands available in scripts/cii/ directory.
AI Security Branch
Load from references/ai-security/ for overview and guidance, and templates/ai-security/ for assessment checklists → generate security hardening code for AI pipelines, model security, API protection, LLM guardrails.
Robot Security Branch
Load from templates/robot-security/ → generate robot security remediation guidance for secure development, supply chain controls, IEC 62443 controls, cyber resilience planning, and wireless security.
Space Security Branch
Load from references/space-security/ for overview and supply chain guidance, and templates/space-security/ for assessment checklists → generate space system hardening guidance. Fix scripts in scripts/space-security/access-control-fix.md, scripts/space-security/system-security-fix.md, scripts/space-security/operations-fix.md.
Secure Coding Branch
Load from references/secure-coding/pseudocode.md for UNSAFE→SAFE pattern pairs. Use templates/secure-coding/javascript.md or templates/secure-coding/python.md for framework-specific fixes. Each item provides the exact code transformation (UNSAFE → SAFE) to apply.
Zero Trust Branch
Load from references/zero-trust/ for maturity model and architecture, and templates/zero-trust/ for element-specific checklists. Generate remediation guidance based on gap analysis between current and target maturity levels. If OT/ICS detected, also load templates/zero-trust/ot-environment.md and references/zero-trust/ot-guide.md.
| Topic | Reference File |
|---|---|
| Overview | templates/zero-trust/overview.md |
| Identity & Device | templates/zero-trust/identity-device.md |
| Network & System | templates/zero-trust/network-system.md |
| Application & Data | templates/zero-trust/app-data.md |
| Visibility & Automation | templates/zero-trust/visibility-automation.md |
| OT/ICS Environment | templates/zero-trust/ot-environment.md |
| ZT Architecture Reference | references/zero-trust/overview.md |
| Maturity Model Details | references/zero-trust/maturity-model.md |
| OT Deployment Guide | references/zero-trust/ot-guide.md |
8 core elements, ~396 items across 4 maturity levels. Standards: KISA ZT Guideline 2.0, NIST SP 800-207, CISA ZT Maturity Model.
SW Supply Chain Branch
Load from references/supply-chain/overview.md for C-SCRM/SBOM context. Use scripts/supply-chain/sbom-generate.md for SBOM generation commands (Syft, CycloneDX, language-specific tools). Use scripts/supply-chain/sbom-vuln-scan.md for vulnerability scanning (Grype, npm audit, pip-audit, govulncheck) and license compliance checks. Reference templates/supply-chain/sbom-checklist.md for the 29-item remediation checklist.
Fix workflow: Generate SBOM → Scan vulnerabilities → Prioritize by CVSS → Apply patches → Verify → Update SBOM.
Notes
- Always backup before applying fixes
- Test in non-production first
- Document all changes for compliance audit


