Overview
Shieldome ships with a built-in AI assistant that understands your scan results and can answer questions, explain findings, suggest fixes, and write penetration testing narratives. The assistant runs entirely on your local Ollama instance - no data is sent to any cloud AI provider.
The AI assistant covers three distinct capabilities:
- Multi-turn chat - conversational Q&A about any scan, with full conversation memory across turns
- AI early triage - automated background analysis that fires during a scan when critical or high findings are detected, before the scan finishes
- Pentest narrative - generates a complete executive-level write-up of findings suitable for inclusion in a penetration testing report
Requirements
The AI assistant requires an Ollama instance reachable from the Shieldome server. Configure the connection in your environment:
OLLAMA_HOST=http://10.0.1.71:11434 # default: http://localhost:11434 OLLAMA_FAST_MODEL=mistral:7b # fast responses, triage OLLAMA_SMART_MODEL=llama3.1:8b # detailed analysis, narratives
If Ollama is not configured or unreachable, the AI features degrade gracefully - chat shows an error message, early triage is skipped, and the rest of the scanner continues working normally.
Multi-turn AI chat
Open any scan and click the AI Chat button (the brain icon in the top action bar). A chat panel opens with full context of your scan results pre-loaded.
What you can ask
- "What is the most critical finding and how do I fix it?"
- "Are any of these findings likely false positives?"
- "Explain the SQL injection finding to a developer who hasn't seen this before"
- "Which findings would an attacker chain together to escalate privilege?"
- "Write a ticket description for the missing HSTS header finding"
- "How long would it take to remediate all high and critical findings?"
Conversation memory
The chat panel maintains full conversation history within the session. Follow-up questions understand prior context - you can ask "what did you mean by that?" or "show me the same thing but for low severity findings" without repeating yourself. The conversation resets when you close the panel or load a different scan.
Response caching
Per-finding AI analysis results are cached in Redis for 7 days. Repeated questions about the same finding return instantly. Cache is keyed by finding content - if the finding changes between scans, a fresh analysis is generated.
AI early triage
Early triage fires automatically during a scan - you don't need to open the chat panel. When the scanner detects 2 or more critical or high severity findings and the scan is between 20% and 70% complete, a background analysis is triggered.
What it does
The early triage analysis uses the fast model to:
- Rank the detected findings by exploitability and business impact
- Identify any attack chains - combinations of findings that compound each other
- Flag findings that are likely false positives based on context
- Surface the single most urgent action to take before the scan finishes
Where to see it
Early triage results appear in the AI Triage tab of a scan while it is still in progress. The tab becomes available as soon as the background analysis completes - typically 30 to 90 seconds after the trigger condition is met. The tab updates again with a full analysis once the scan completes.
Pentest narrative
The pentest narrative generates a complete written section suitable for a professional penetration testing report. It is written from the perspective of an external attacker who found the same findings your scan discovered.
How to generate
- Open a completed scan
- Click AI Narrative in the action bar (or open AI Chat and ask "write a pentest narrative")
- The smart model generates a structured report section covering: executive summary, attack surface overview, finding details with exploitation context, risk ratings with justification, and remediation recommendations
Structure of the output
| Section | Content |
|---|---|
| Executive summary | 2-3 paragraph overview of overall risk posture, key findings, and recommended immediate actions - written for a non-technical audience |
| Attack surface | Summary of what was tested: URL, technology stack, number of findings by severity |
| Findings detail | Each critical and high finding written up with: what was found, how it could be exploited, business impact, and remediation steps |
| Risk matrix | All findings mapped to likelihood and impact, with overall risk rating |
| Remediation roadmap | Prioritized fix list with estimated effort levels |
Privacy and data handling
Scan data sent to the AI assistant is processed exclusively by the Ollama instance you configure. The data path is:
Browser → Shieldome server → Ollama (your instance) → Shieldome server → Browser
Nothing passes through any external AI API. If you are self-hosting Shieldome and running Ollama on the same machine, all processing is fully air-gapped from external networks.