Orca Security integrated Generative Pre-trained Transformer 3 (GPT-3) developed by Open AI into its cloud security platform to enhance the detail and accuracy of remediation steps, a move the security vendor claims helps differentiate it from other competitors in the market.

GPT-3 is an autoregressive language model using machine learning (ML) to generate text. “Given any text prompt like a phrase or a sentence, GPT-3 returns a text completion in natural language,” according to Open AI. The ChatGPT natural language processing model is built on the GPT-3 family of large-language models.

Orca says it has been exploring the use of artificial intelligence (AI) for its cloud security platform and the GPT-3 integration is a prime example. The vendor’s platform includes capabilities such as cloud security posture management (CSPM), cloud workload protection platform, and container and shift-left security.

Orca adopted the GPT-3 "Da-Vinci-03" series API to generate contextual remediation plans for security alerts. The vendor built a pipeline to take in security alerts that consist of basic information about the risk and its contextual environment, feeds the pre-processed data into GPT-3 to generate detailed explanations of how to remediate the issues, and embeds these remediation steps in tickets opened to DevOps and research and development teams.

Orca claims it has fine tuned the models with its own security data sets and added several layers of input data filtering and sanitation to ensure data privacy and security. Customers can use the GPT-3 tool to remediate findings via the command line, infrastructure-as-code (IAC) platforms like Terraform or Pulumi, or the console. Customers can also ask follow-up questions and fine-tune the remediation steps based on their needs.

“The integration of GPT-3 into our cloud security platform allows us to offer a one-of-a-kind remediation experience, instantly generating high-quality remediation recommendations that can be implemented by our customers with minimal effort,” Lior Drihem, director of innovation at Orca Security, wrote in response to questions. “Through Orca’s existing integrations, recommended remediation steps can be automatically included when issues are assigned to other teams, such as DevOps and R&D, using Jira, PagerDuty, Slack, and many more.”

GPT-3’s output depends on the data and information it has been trained on, which is heavily based on the Common Crawl dataset up to June 2021.

To reduce potential errors and risks, Orca implemented a validation step to cross-check the output of the GPT-3 model with its internal security guidelines and best practices. The company also set up a feedback mechanism that allows customers to provide feedback on the remediation process that allows Orca to fine tune the model and tailor it to customers’ needs, Drihem explained.

“It is important to note that there is always an element of uncertainty when interacting with an AI model. However, we believe that the benefits of utilizing GPT-3's natural language generation capabilities outweigh any potential risks,” Drihem argues. “Our integration of GPT-3 has already led to significant improvements in the efficiency and effectiveness of our remediation efforts.”