RiskRank: Context-Aware Vulnerability Prioritization : Human-Overseen Decision Support for AI-Assisted Workflows

Sammanfattning

AI-assisted and agentic coding workflows can increase the volume of code entering delivery pipelines, making automated security review increasingly important. Yet static analysis tools often produce more findings than teams can review immediately, and severity labels alone do not capture repository-specific context such as reachability, architectural centrality, maintenance activity, or business-critical flows. This study investigates context-aware post-detection vulnerability prioritization through RiskRank, a proof-of-concept approach that treats prioritization not as another detection task, but as a decision-support layer between automated scanning and human remediation. The implemented pipeline combines vulnerability findings with structural, evolutionary, and LLM-derived contextual signals to produce reviewer-facing prioritization artifacts. Evaluation is conducted through descriptive online and in-person user feedback together with a six-repository technical check across Node-Goat, DVNA, DVWA, XVWA, OWASP Juice Shop, and WackoPicko. The findings suggest that explanation-rich prioritization is perceived as more useful and actionable when framed as human-overseen support rather than autonomous judgment. The repeated-run WackoPicko experiment further indicates that, under the tested configuration, reviewer-facing ordering can remain stable even when exact LLM outputs vary. Taken together, the results support RiskRank as a practical starting point forcontextual vulnerability triage in CI/CD, while also showing that interpretability,user trust, and stability are central conditions for any future mature deployment.