A technical rundown of what changed in AI Cybersecurity News Automator Pro and why removing a feature made the product better
I’ve been running this n8n workflow for a while now: it pulls cybersecurity RSS feeds, cross-references CVEs against CISA’s Known Exploited Vulnerabilities list, and uses a local Ollama model to write a short threat briefing that lands in Discord, Slack, Telegram, or your inbox. It’s the kind of thing that’s genuinely useful if you’re a solo security engineer, a small MSP, or a SOC team that doesn’t have a dedicated analyst reading fifteen feeds every morning.
This update touches five things: sources, configuration, positioning, cost, and safety. None of them are cosmetic. Here’s what changed and why.
More sources, and better-chosen ones
The workflow shipped with six feeds, Paranoid Cybersecurity, The Hacker News, BleepingComputer, a CVE feed, CISA Advisories, and CERT-FR. Solid coverage, but it leaned toward news aggregation: fast reporting on what already happened.
I added three more: Krebs on Security, Unit 42, and Securelist. That’s not just three more RSS URLs, it’s a different kind of signal. Krebs does investigative journalism that surfaces stories the wire feeds miss entirely. Unit 42 and Securelist are threat-research shops; they publish APT tracking and malware analysis that tells you how something works, not just that it happened. Nine feeds now, and the mix is deliberately broader: fast news, government advisories, and slower, deeper research side by side.
Configuration without touching code
Previously, if you wanted to change the lookback window, or how many articles the LLM saw, or whether it sent live or just previewed — you were opening a Code node and editing JavaScript. That’s fine for me. It’s a bad experience for someone who bought a template specifically so they wouldn’t have to write pipeline code.
This update adds a single Config node at the front of the workflow — a plain Set node with five fields: watchlistKeywords, lookbackHours, llmEnabled, maxArticlesToLLM, and dryRun. Every downstream node reads from it. Want a 12-hour window instead of 24? Change one number. Want to kill the LLM entirely and run on the free deterministic formatter? Flip one boolean. No code node to hunt through, no risk of breaking a regex while you're just trying to change a threshold.
Dropping the stack-monitor disguise
This is the change I think matters most, and it’s a removal, not an addition.
The original aggregator had a hardcoded array of infrastructure keywords baked into the code wazuh, apache, nginx, ubuntu, and so on used to flag articles that "impacted our infra." It made sense when I built it for my own stack. But shipped as a product, it meant every buyer inherited my infrastructure assumptions, and the workflow read like a narrow stack-monitoring tool wearing a general-news costume. I also sell an actual stack monitor, this wasn't supposed to be that.
I pulled the hardcoded list out entirely. In its place: an optional watchlistKeywords field in the Config node, empty by default. Out of the box, this is now a pure general cybersecurity news digest no assumptions about what you run. If you do want infra-specific tagging, type a comma-separated list into one field and matched articles get flagged, no code required. The behavior is the same; the honesty is different. A product that does one thing well beats a product quietly trying to be two things.
Cutting AI cost to near zero for routine runs
This one’s the practical payoff. The workflow runs every six hours by default. Before this update, every single run called the LLM to generate a digest, whether or not anything happened. That’s a lot of tokens spent narrating “nothing new today.”
Four changes fix that:
- Early exit. If a run finds zero new articles, it stops before reaching the LLM. No new news, no generation call.
- LLM only on critical events. The routine standard digest the one that fires most runs now uses a deterministic formatter with zero LLM calls. The model only runs when something’s flagged CRITICAL or listed in CISA’s KEV feed. That’s the branch where synthesis actually earns its cost; the rest is templated text.
- Slim payload. When the LLM does run, it gets a trimmed set of fields title, source, CVE, severity capped at roughly eight items, instead of full article bodies as JSON blobs.
- A master switch. llmEnabled in Config turns the model off entirely if you want the whole pipeline running on deterministic formatting, full stop.
Net effect: most six-hour cycles now cost nothing in LLM tokens. The model still writes the briefings that need real judgment, the ones flagging active exploitation it just isn’t burning credits narrating quiet Tuesdays.
Dry-run by default
Every delivery channel Discord, Telegram, Slack, email, now sits behind a dry-run gate. Ship it, install it, run it: with dryRun on (the default), nothing actually sends. You get a preview instead. Flip one flag in Config once you've confirmed the pipeline looks right, and it goes live. It's a small change, but it's the difference between testing a new automation safely and finding out the hard way that your webhook URL was wrong.
What this adds up to
None of these changes are flashy individually. Taken together, they move the product from “useful thing I built for myself” to “thing I’d hand a stranger with a straight face”: broader source coverage, configuration that doesn’t require reading JavaScript, honest positioning about what it actually does, a fraction of the ongoing AI cost, and a safety net for the first run.
Video Demo
https://medium.com/media/4a358144a779d3982bbe6c9fb0abff55/hrefGet the Workflow
The AI Cybersecurity News Automator Pro Edition is available now on my store as a ready-to-import n8n JSON with full setup documentation.
👉 Get it from — Here
👉 Pay with Paypal — Here
For More Automations Check https://neetrox.com
Why I Stopped Pretending My Threat-News Bot Was a Stack Monitor was originally published in System Weakness on Medium, where people are continuing the conversation by highlighting and responding to this story.