On the afternoon of Thursday, June 25, 2026, the Information Technology Institute (ITI), Vietnam National University, Hanoi (VNU) organized its periodic technology seminar themed “AI-integrated virtual assistant system for attack surface management and risk mitigation.” The event took place at E3 Building, 144 Xuan Thuy Street, Cau Giay District, Hanoi. The seminar was chaired by Dr. Nguyen Viet Cuong (Information Technology Institute, VNU) and featured Mr. Nguyen Tuan Thanh (University of Engineering and Technology, VNU) as the keynote speaker. The event attracted a large number of researchers and institute officials who actively participated in exchanges and discussions regarding the professional content of the report.
At the beginning of the report, the speaker presented the problem statement and research motivation. The attack surface of digital organizations is expanding faster than manual tracking capabilities: a typical organization can possess dozens of domains, hundreds of web services, and thousands of concurrent endpoints, with many assets falling outside the direct control of the security team. External Attack Surface Management (EASM) was introduced to continuously discover, monitor, and assess risks on Internet-facing assets. The speaker pointed out that most current solutions are either standalone tools or closed commercial products, lacking an open-source platform integrated with an artificial intelligence-based virtual assistant.
Driven by this motivation, the report introduced OASM-Platform, an open-source EASM platform built around a five-stage EASM cycle. The speaker presented the core technological components of the system, including: an AI Agent architecture for task orchestration; a Skill system featuring semantic search based on the pgvector database; the integration of the Model Context Protocol (MCP) to connect the virtual assistant with security tools; a multi-LLM (large language model) provider framework allowing the system to be independent of a single provider; and a distributed scanning engine responsible for large-scale asset data collection.
A highlight of the report was the story of architectural redesign to address the issue of data consistency. In the early stages, the system stored vector embeddings separately from business data, leading to a situation where the two repositories became out of sync and the virtual assistant continued to suggest Skills that had been deleted. The speaker shared that the development team co-located the vector storage and business data using pgvector, thereby eliminating this consistency flaw and significantly reducing latency by removing the intermediate communication layer. This serves as a practical example demonstrating how an architectural decision can directly impact the reliability of an AI system.
Next, the speaker presented the Skill system, designed as a living knowledge base for the organization, combining Markdown-formatted documents, semantic retrieval, and a progressive disclosure mechanism to save the model’s context window. The experimental phase evaluated the system across multiple criteria groups regarding Skill selection accuracy, retrieval quality, and response performance. From the results obtained, the speaker drew a notable technical lesson regarding the consistency of the embedding space in RAG systems: when the indexing stage and the query stage use two different embedding models, semantic retrieval quality degrades severely. This is a valuable observation that provides orientation for designing future Retrieval-Augmented Generation systems.
The discussion session took place vibrantly. Researchers from the Institute showed great interest in the choice of AI models used in the system, the coordination among large language model providers, and the evaluation mechanism for the virtual assistant’s answer quality. Additionally, several questions focused on attack scenarios and how the system processes input data from scanning results.
