Six layers, one defense loop
Drag the model to turn it, or pick a layer to see what it does. Data enters at the bottom, is analysed by the CNN and the RAG engine, reasoned over by the LLM, and acted on by the agents at the top.
Global threat globe
Simulated attack traffic between twelve monitored sites. Drag to spin the globe, raise the rate to stress the pipeline. The landmasses are stylised, and none of the traffic is real.
Live security console
A simulated stream of security events, triaged the way Sentinel-X would triage them. Trigger a surge to watch the pipeline under load, then export a snapshot.
MITRE ATT&CK coverage
Every event, scan, log finding and incident above lights up the technique it maps to. Warmer cells have been seen more often.
CNN lab: see malware as an image
Security researchers turn a file's bytes into a grayscale picture, then let a convolutional network recognise the texture of each malware family. Generate a sample or drop in any file from your device.
Files are read in your browser. They are only sent anywhere if you connect your own backend below.
Family probabilities
The page runs a lightweight feature-based stand-in (byte entropy and repetition patterns) so the demo works offline. With the Docker backend connected, files go to the vision service, which can serve a trained PyTorch CNN.
RAG: answers grounded in threat intelligence
Ask a security question. Sentinel-X retrieves the most relevant knowledge chunks, writes an answer from them and cites every source. When nothing relevant exists, it says so instead of guessing.
Retrieval uses TF-IDF similarity. The upgrade path is embeddings in a vector database with a reranker. Retrieved text is treated as data, never as instructions.
Agentic AI: from alert to report
Pick an incident and watch six cooperating agents handle it. The analyst agent really calls the retrieval engine and the CNN above. Containment waits for your approval unless you switch that off.
- Choose an incident above to start.
Dry-run mode: actions are simulated and no real system is touched.
Security toolkit
Three working tools that run entirely in your browser: a phishing link checker, a password strength estimator and a log forensics analyser.
Everything stays on this page and nothing is stored. Still, test made-up passwords rather than your real ones. The estimate assumes a fast offline attack of 10 billion guesses per second and is a rough guide only.
Sentinel Copilot
A conversational front end for everything above. Ask a question, paste a link to check, or tell it to run an incident. You can speak to it and have answers read aloud on supported browsers.
Docker: one command, six services
Each component is a hardened container on segmented networks. Only the web dashboard is exposed. The analysis services sit on an internal network with no internet access.
Start it with docker compose up -d --build, then open http://localhost:3000.
| Service | Technology | Network | Role |
|---|
Connect the backend
Optional. When connected, RAG search and the CNN lab use your Docker services instead of the in-browser versions. Enter / if this page is served by the Docker web container, or a gateway address such as http://localhost:8000.
Not connected (running fully in your browser)
Built to be trusted
A security tool that uses AI must be secure and accountable itself. These are the rules the design follows.
Securing the system
- Least privilege. Containers run as non-root with a read-only filesystem and no extra capabilities.
- Segmented networks. Analysis services have no route to the internet or the outside world.
- Gateway controls. Optional API key, rate limiting, upload limits and security headers.
- Strict browser policy. The web container sends a content security policy and other hardening headers.
- Audit trail. Every agent step and tool call is recorded in the run timeline.
Using AI responsibly
- Prompt-injection defense. Retrieved text and log lines are data. Tools are allow-listed.
- Human in the loop. Containment needs approval by default and runs in dry-run mode.
- Grounded answers. Claims cite sources, and unsupported questions are refused.
- Explainable verdicts. The CNN lab shows where it looked, and findings list their evidence.
- Privacy first. The browser demos send nothing anywhere, and the LLM can run locally.
These are engineering targets for the full build, not measured results.
Roadmap
Foundation
Log ingestion, event schema, dashboard and the Docker base with hardened containers.
Intelligence
Train the CNN on public malware image datasets and move retrieval to embeddings in a vector database.
Autonomy
Connect a local LLM and agents with tool policies, approval gates and audit logging.
Hardening
Red-team the agents, evaluate accuracy and grounding, and add Kubernetes deployment.
Next horizon
Planned research directions, not yet built.
Federated learning
Train the CNN across sites without sharing raw files.
Post-quantum readiness
Inventory cryptography and prepare migration to quantum-safe algorithms.
On-device LLM
Run a small model in the browser with WebGPU for fully private analysis.
Edge sensors
Deploy lightweight agents on Raspberry Pi and Jetson class devices.
Attack-path graphs
Model assets and permissions as a graph to predict lateral movement.
Automated red team
Continuously attack the agents with prompt-injection suites and score their defenses.