Abstract
Newly disclosed vulnerabilities create urgent asset-specific decisions before complete structured product and configuration metadata are available. Existing language-model approaches can extract affected components, interpret reports, and produce fluent conclusions but may confuse missing evidence with evidence of safety, overlook conditional vulnerability prerequisites or use information published after the decision date. The proposed CyberSentinel-MEC study asks whether minimum-evidence certificates and certificate-guided active verification can improve the reliability and efficiency of these early assessments. Given a time-frozen advisory bundle and a partially known asset state, the method will extract typed conditions, preserve provenance and timestamps, distinguish guaranteed applicability from guaranteed non-applicability and unresolved cases, construct checkable evidence certificates, and select a read-only fact to verify when the evidence is insufficient. The method will be assessed against direct LLMs, time-frozen retrieval, structured matching, generic active information acquisition, and evidence-gating baselines on real advisory families, historical revisions, and independently validated counterfactual cases. Primary outcomes are false-safe decisions at matched decision coverage and the cost of reaching a justified verdict. The project is limited to vulnerability applicability and diagnostic evidence acquisition, not exploit prediction, autonomous remediation, or proven prevention of real attacks. Its scientific novelty and publication suitability remain subject to direct comparison with the strongest prior methods and results on held-out data.