The Department of Energy's Pacific Northwest National Laboratory has transitioned an artificial intelligence-based cybersecurity research effort into operational use to strengthen cyber defense.
Register today for the Potomac Officers Club's 2026 Cyber Summit on May 21 to join top government and industry leaders addressing escalating cyber threats, zero trust progress ahead of the 2027 deadline and the future of cybersecurity.
Table of Contents
How Does the MERU Technology Work?
PNNL said Thursday the new technology, dubbed Multimodal Entity Relationship Unification, or MERU, uses AI and graph theory to connect databases and train the system to extract key information while adapting to new data and environments. Developed by a team of PNNL researchers led by Chief Computer Scientist Mahantesh Halappanavar, MERU creates a “free-flowing stream of data” that connects global threat intelligence with a company's specific computing setup.
It integrates up-to-date news about cyber attacks with databases such as the National Vulnerability Database, Common Weakness Enumeration, Common Attack Pattern Enumeration and Classification, and MITRE ATT&CK to provide a unified view of risks. This enables security teams to understand how attacks happen and help them identify and stop threats before they cause serious damage.
What Impact Has MERU Shown?
Early implementation by PNNL's IT operations team has enabled rapid identification of high-priority threats and the creation of roadmaps to halt likely attacks. Joseph Aguayo, PNNL deputy chief information security officer, stated that the program breaks down massive amounts of threat intelligence into actionable insights. The capability is particularly vital for defending against zero-day attacks, where security teams must adapt defenses in real-time before official software patches become available.
