ONEKEY Launches AI Agent: Conversational Vulnerability Investigation, SBOM and Component Exploration
- New AI capability provides direct access to firmware security data through natural language – the first milestone in ONEKEY’s AI roadmap
- Jan Wendenburg, CEO of ONEKEY: “When a critical vulnerability emerges, every hour counts. If you first have to hunt down where the affected component is hiding, you’re losing valuable time.”
Düsseldorf, Germany, October 21, 2026 – Cybersecurity company ONEKEY has released the first version of its ONEKEY AI Agent, bringing AI-powered assistance directly to customers within its firmware and product security platform. The AI Agent answers questions in natural language and covers six core functions: It takes into account the context of the currently open view, supports vulnerability investigation, enables exploration of the Software Bill of Materials (SBOM) and its components, assists in building and refining queries in the ONEKEY Query Language (OQL), answers questions about using the platform and, in supported environments, lets customers connect their own AI model through an OpenAI-compatible API (“Bring Your Own Model”).
This announcement takes a closer look at two of the six functions: vulnerability investigation and SBOM and component exploration. Vulnerability investigation helps assess the security risks of a specific firmware image, while SBOM exploration makes it possible to trace software components and how they are used across different firmware versions.
The ONEKEY AI Agent can answer questions such as “What does this vulnerability mean for my firmware?” or “Which of my firmware versions contain the affected component?”
“Given the flood of new vulnerabilities, it’s an enormous help for security teams to be able to find out instantly and with minimal effort which components in connected devices, machines and industrial systems are affected,” said ONEKEY CEO Jan Wendenburg. “Our AI Agent takes them straight to the right answer.”
The AI Agent addresses a core problem in securing the software that runs connected devices, machines and industrial systems: Firmware security data is extensive and complex. Security teams need to know which software components are used in their products and what risks vulnerabilities pose. Until now, this has involved manually compiling much of the relevant information: the vulnerability description, the affected component and versions, the firmware analysis results, information on exploitability and possible mitigations. Those responsible also need to know where to look, which pieces of information belong together and how to interpret the analysis results. The AI Agent makes this information far easier to access and significantly reduces the effort required to investigate vulnerabilities.
Investigate and Assess Vulnerabilities Faster
With AI-assisted vulnerability investigation, users can ask questions directly in the context of the analyzed firmware: What’s behind this reported vulnerability? Is it relevant to my firmware? How severe is it, and can it be exploited? Which mitigations should be considered?
The analytical capabilities of the ONEKEY platform work hand in hand with the conversational capabilities of the AI Agent. First, the platform analyzes the firmware and lists all detected components and versions. Users can then “talk through” these results in detail with the AI Agent. The agent combines available public vulnerability information with the specific firmware and analysis context, helping users assess relevance, severity, exploitability and possible mitigations.
“The AI Agent takes the tedious cross-referencing off teams’ plates,” Wendenburg explained. “They can see more quickly which vulnerabilities really require closer investigation and which do not.” This enables security teams to move faster from vulnerability notification to assessment and prioritization, eliminating much of the time-consuming research involved in their daily work.
SBOM and Component Exploration: Discovering Software Components Through Conversation
Another core capability of the ONEKEY AI Agent is the exploration of Software Bills of Materials (SBOMs) and the components they contain. SBOMs and firmware analyses often include a large number of components and versions. With the AI Agent, users can explore SBOMs, components, versions, known vulnerabilities, and affected products through natural-language questions: Which components are present? Which vulnerabilities are associated with them? Which products use a particular library?
The foundation is the SBOM that ONEKEY automatically generates from the firmware during analysis. The AI Agent does not create the SBOM itself; it comes from the ONEKEY platform’s component detection. The AI Agent makes this information easier to access and enables users to trace components and their usage across different firmware versions, rather than examining just a single firmware version.
This capability is especially important when a new critical vulnerability becomes known. “At that point, manufacturers need to know immediately which products and firmware versions contain the component,” emphasized Jan Wendenburg. “That’s exactly the answer the AI Agent delivers – including the firmware delivered by suppliers.” For customers, this means they can quickly identify affected products, including those involving components from their supply chain.
Evidence First, Then AI
Both functions rest on the same principle: Because the ONEKEY AI Agent is integrated into the platform, it works from deterministic – that is, reproducible – analysis results. The platform first generates reliable firmware security information through firmware extraction, binary analysis, component detection for the SBOM, matching against vulnerability data and impact assessment. This ensures that the same firmware, analyzed using the same process, consistently yields the same components, versions and vulnerability matches. ONEKEY sums up the principle this way: evidence first, then AI-assisted assessment. “The AI doesn’t invent vulnerabilities, and it doesn’t explain any away,” Wendenburg emphasized. “It works with what our analysis proves.”
This approach shapes ONEKEY’s entire AI strategy. “AI alone doesn’t inherently make firmware secure,” Wendenburg said. When used to search for vulnerabilities, large language models often produce results that are hard to reproduce. Yet before releasing a new firmware version, developers need to be able to tell whether the code is insecure or whether the model’s answer is simply inconsistent. In the ONEKEY platform, the analysis is complemented by automation and continuous monitoring across the entire product lifecycle.
First Stage of the AI Roadmap
With the AI Agent, ONEKEY is implementing the first stage of its four-stage roadmap for AI-assisted security decision-making:
- Stage 1: Make security knowledge available in natural language, with answers grounded directly in the platform’s analysis results.
- Stage 2: Open up security data, in a controlled way, to customers’ own AI agents, applications and automated workflows.
- Stage 3: Support users in making security decisions.
- Stage 4: Assist with end-to-end security workflows, such as technical reports or comparative analyses across multiple firmware images.
At every stage, the final assessment remains with a human.
“Our roadmap shows how AI-assisted security decision-making is becoming reality step by step – as trustworthy support for the people who make security-critical decisions every day,” said Wendenburg.
ONEKEY is the leading European specialist in Product Cybersecurity & Compliance Management and part of the investment portfolio of PricewaterhouseCoopers Germany (PwC). The unique combination of the automated ONEKEY Product Cybersecurity & Compliance Platform (OCP) with expert knowledge and consulting services provides fast and comprehensive analysis, support, and management to improve product cybersecurity and compliance from product purchasing, design, development, production to end-of-life.
Critical vulnerabilities and compliance violations in device firmware are automatically identified in binary code by AI-based technology in minutes – without source code, device, or network access. Proactively audit software supply chains with integrated Software Bills of Materials (SBOMs) generation. “Digital Cyber Twins” enable automated 24/7 post-release cybersecurity monitoring throughout the product lifecycle.
The integrated ONEKEY Compliance Wizard already supports compliance with requirements from IEC 62443-4-2, ETSI EN 303 645, UNECE R155, and many other standards and regulations.
As part of the EU-funded CRACoWi (Cyber Resilience Act Compliance Wizard) project, ONEKEY is collaborating with 13 European partners to develop an AI-powered assistant for the automated implementation of the EU Cyber Resilience Act (CRA).
The solution will guide companies through the entire compliance process—from the initial CRA scope assessment to the generation of the required Declaration of Conformity.
The Product Security Incident Response Team (PSIRT) is effectively supported by the integrated automatic prioritization of vulnerabilities, significantly reducing the time to remediation.
Leading international companies in Asia, Europe and the Americas already benefit from the ONEKEY Product Cybersecurity & Compliance Platform (OCP) and ONEKEY Cybersecurity Experts.