AI-Assisted Threat Assessment

How AI Analysis Works

When a website is submitted, VerAI invokes external language-model services with a prompt asking them to assess whether the supplied website appears legitimate or suspicious.

The prompts emphasize potential red flags associated with cybersecurity threats.

AI Integrations

The supplied implementation contains integrations for:

Provider	Main Workflow Status	Purpose
Groq	Called during website analysis	Generate security-focused observations
OpenAI	Called during website analysis	Generate security-focused observations
Google Gemini	Function present but not called by the main analysis route	Additional AI assessment capability in the source

The exact availability of an integration depends on valid credentials, compatible APIs, and service availability.

Running an AI Assessment

Enter a website URL.
Submit the Website Analysis form.
Allow the technical checks and AI calls to complete.
Review any returned AI observations.
Compare those observations with the technical results.

AI results are shown alongside the website analysis data where supported by the results template.

What the AI Is Asked to Evaluate

The implementation requests observations concerning suspicious website behavior and legitimacy.

Topics mentioned in the prompts include:

Phishing
Scams
Malware
Other potential security threats
General legitimacy concerns

Understanding AI Findings

An AI response may identify potential warning signs such as a suspicious-looking domain name or an apparent impersonation pattern.

However, the supplied code passes the website URL as text to the AI integrations.

It does not pass the complete independently collected technical report into those prompts.

Consequently, the model's observations are not guaranteed to be based on a live inspection of the website.

AI vs. Technical Intelligence

Source	Type of Information
DNS	Observed domain configuration
TLS	Observed connection and certificate data
WHOIS	Retrieved registration metadata
Safe Browsing	Provider threat-match results
AI Assessment	Model-generated observations

AI analysis should complement, not replace, independent evidence.

False Positives

An AI model may incorrectly characterize a legitimate website as suspicious.

This can occur because of:

Unusual domain naming
Limited contextual information
Outdated model knowledge
Ambiguous website identity
Inference without direct evidence

False Negatives

An AI model may also fail to recognize malicious websites.

A convincing phishing website can resemble a legitimate service.

New threats or websites may not be known to the model.

External Data Sharing

Website identifiers are submitted to external AI providers.

Users should avoid including confidential information in URLs, such as:

Authentication tokens
Session identifiers
Private query parameters
Passwords
Sensitive document links

Error Handling

An AI integration may return an error if:

Its credentials are invalid
The API is unavailable
The model is unavailable
The request times out
The account has reached a usage limit

An AI integration error should not be interpreted as a website security finding.

Important Implementation Detail

The code's copilot_response label refers to a function that calls the OpenAI API.

It should not be assumed to represent a separate Microsoft Copilot security analysis service.

The exact model names in the supplied source may also require updating for compatibility with current provider APIs.

Recommended Use

Use AI output to identify questions worth investigating, then verify those questions against:

Technical website configuration
Trustworthy threat intelligence
Verified organizational information
Independent reporting or evidence
Other appropriate security tools

Remember: AI-generated security observations are advisory and may be inaccurate. They should never be the sole basis for declaring a website safe or malicious.