arXiv: When to Trust the Map: Confidence-Aware LLM Routing for Automotive CVE-to-ATM Mapping

This publication from July 2026 introduces a novel framework for using large language models to map automotive cybersecurity vulnerabilities (CVEs) to specific attack trees (ATMs) within the automotive sector. The key innovation is a confidence-aware routing mechanism that determines when an LLM’s output can be trusted for automated mapping and when human expert review is required. This addresses a critical gap in current AI safety and compliance practices, where automated tools may produce unreliable or unverifiable mappings that could lead to incorrect risk assessments or regulatory reporting.

The primary affected organizations are automotive manufacturers, suppliers, and fleet operators subject to UN Regulation No. 155 (cybersecurity management systems) and the EU’s upcoming AI Act. Compliance teams in these sectors must now consider how AI-driven vulnerability mapping tools are validated and audited. The framework implies that regulators may expect demonstrable confidence thresholds and human-in-the-loop processes for any automated CVE-to-ATM mapping used in safety-critical decisions.

Compliance teams should immediately review any existing or planned use of LLMs for vulnerability mapping. They must document the confidence thresholds used, ensure human oversight for low-confidence mappings, and prepare audit trails showing how mapping accuracy is measured. Additionally, teams should engage with technical leads to assess whether this confidence-aware routing approach can be integrated into their current cybersecurity compliance workflows to meet emerging AI safety standards.