-
-
AEGIS live dashboard real-time threat ticker, CVE severity counters,and four autonomous intelligence playbooks powered by Elastic and Gemini
-
Daily Threat Brief playbook - live CVEs from the Elastic index mapped to PCI-DSS v4.0 requirements, with remediation guidance per finding.
-
Gemini 2.5 Flash autonomously calling searchCVEs and complianceReport via Elastic MCP after one trigger message. No prompting required.
-
15 CVEs mapped to exact PCI-DSS v4.0 requirements with verified remediation commands. Audit-ready. Zero prompts required.
Inspiration
Most early-stage fintechs are running infrastructure like Stripe, Plaid, and MongoDB in production without any real visibility into the CVEs that affect those exact dependencies. Enterprise threat intelligence platforms (like Recorded Future or Tenable) exist, but they start at $50,000 a year. On the flip side, a single PCI-DSS violation from a missed vulnerability can cost $500,000. The math is brutal for any small team. We wanted to build the solution that closes this gap—delivering enterprise-grade threat intelligence without requiring a dedicated security team or a massive budget.
What it does
AEGIS is an autonomous threat intelligence agent designed specifically for fintech stacks. It continuously monitors your payment infrastructure (Node.js, MongoDB, Stripe SDK, Plaid SDK, and GCP Cloud Run) against live threat data. Crucially, it maps every critical CVE to the exact PCI-DSS requirement it threatens.
Without requiring a single user prompt, AEGIS runs four autonomous playbooks:
Daily threat brief: Highlights new CVEs affecting your registered stack.
Morning intelligence summary: Details active campaigns targeting the financial sector.
Incident response guide: Provides step-by-step remediation for specific vulnerabilities.
PCI-DSS compliance report: Generates an audit-ready output mapping active threats directly to compliance requirements.
Under the hood, Elastic indexes over 800 financial CVEs, 50,000+ IOCs, and the full MITRE ATT&CK Financial Services matrix, allowing AEGIS to search everything in milliseconds.
How we built it
The agent is powered by Gemini running on Google Cloud Agent Builder. We used an Elastic MCP server as the primary tool interface. Every playbook triggers a sequence of Elastic searches, and Gemini then reasons over the results to produce structured, actionable output.
Threat data is actively ingested from multiple intelligence feeds, including CISA KEV, NVD, AlienVault OTX, Abuse.ch, and MITRE ATT&CK. Our frontend is built with Flask and deployed on Google Cloud Run. To bridge the compliance gap, we manually built a static pci_dss_map.json file that maps the ~800 in-scope CVE IDs directly to the specific PCI-DSS requirements they violate.
Challenges we ran into
Our biggest hurdle was hallucination control. AI models can sometimes confidently invent MITRE T-codes that do not actually exist. We solved this by building a strict validation layer in Flask that cross-checks every generated T-code against our indexed ATT&CK data before rendering it on the frontend. Any unverified codes are explicitly flagged as "Unverified," ensuring users are never misled into acting on fabricated intelligence.
The second major challenge was managing data scope. To keep ingestion lightning-fast and ensure our demo query times stayed under two seconds, we deliberately narrowed our CVE corpus to 2023–2024 and filtered it exclusively to our specific vendor stack.
Accomplishments that we're proud of
True Autonomous Execution: We successfully moved past the typical "chatbot" paradigm. AEGIS doesn't wait for a human to ask a question; it proactively triggers complex query sequences across Elastic using the Model Context Protocol (MCP) and synthesizes actionable briefs entirely in the background. Bulletproof Hallucination Control: In cybersecurity, a hallucinated threat vector or an incorrect tracking code can waste hours of an engineering team's time. Building a robust Flask validation layer that catches and flags unverified MITRE T-codes before they ever reach the UI is something we are incredibly proud of. Sub-2-Second Performance: Optimizing our Elastic index and narrowing the ingestion scope allowed us to keep end-to-end reasoning and query times remarkably fast ($t < 2\text{ s}$), proving that enterprise-grade threat intelligence doesn't have to be sluggish.
What we learned
The Power of MCP with Elasticsearch: We learned how effectively the Model Context Protocol offloads massive data retrieval from the LLM's context window. Instead of forcing Gemini to memorize thousands of indicators of compromise (IOCs), Elastic handles the heavy lifting, allowing the model to focus purely on high-level reasoning.
Compliance Grounding Over Parametric Memory: We quickly realized that even advanced models struggle to accurately map specific vulnerabilities to strict compliance structures out of the box. Grounding the agent's reasoning in a structured, verified mapping file (pci_dss_map.json) yields infinitely better results than relying on raw AI memory for regulatory standards.
What's next for AEGIS — Autonomous Elastic Guardian & Intelligence System
Dynamic Framework Expansion: We plan to scale our compliance engine beyond PCI-DSS to map critical CVEs to other major security frameworks, including SOC 2, ISO 27001, and HIPAA.
Automated Stack Discovery: Instead of relying on a registered stack definition, the next iteration of AEGIS will securely parse live environment configurations (such as Kubernetes manifests or Terraform files) to auto-discover active dependencies.
Active Mitigation Hooks: We want to transition AEGIS from an aggressive threat intelligence agent to an active remediation platform—allowing it to safely draft automated GitHub pull requests for dependency upgrades or generate specific Web Application Firewall (WAF) rules to block active campaigns in real time.
Log in or sign up for Devpost to join the conversation.