What it is
A pipeline that fetches a curated set of cybersecurity sources, uses an LLM to tier each article by GRC relevance on a five-tier scale, and publishes the result as a public live feed on this site. The output reads like something an IT auditor would actually keep open in a browser tab, rather than a firehose of everything cybersecurity.
Why
Portfolio pieces in GRC typically stop at frameworks and policy templates. This one applies the same judgement to a working system, with real code, real containers, and real security controls. It is easier to show that thinking on something that runs than to describe it in the abstract, and the evidence is harder to argue with.
How it works, briefly
A workflow automation runs on n8n, container-isolated on the operator's own machine. Sources are handled with sequential source-by-source processing, so a single misbehaving feed cannot poison the batch. Each article passes through an LLM-assisted tiering step, and the results are emitted as a public JSON feed that the live-feed page on this site consumes. Container hardening includes a read-only filesystem, a non-root user, dropped Linux capabilities, and encrypted credential storage. The specific sources, the tiering prompt, and version details are held back on purpose.
Credit
Adopts a five-tier scoring framework in the spirit of Steve McMichael's Simply Cyber GRC News Assistant work, tuned for financial services IT audit context. Steve's original build inspired the project shape; the implementation, sources, prompt, and hardening choices here are my own.
Full risk assessment (NIST CSF 2.0 structured, following NIST SP 800-30 methodology) · coming as part of v1.5