AEGIS

AEGIS is an AI-powered cyber incident response platform that helps security teams investigate attacks, track compromised data, communicate securely, and coordinate recovery—even when their organization's internal systems can no longer be trusted.

Inspiration

When a cyberattack happens, the damage goes beyond stolen data or compromised servers. Organizations can lose access to the very tools they rely on to investigate and respond to the attack.

Security teams are suddenly left piecing together information from system logs, databases, employee accounts, and network activity. At the same time, they need to figure out what happened, which data was affected, who needs to respond, and how to restore operations.

The problem gets even worse when internal communication tools and authentication systems may also be compromised.

We asked ourselves two questions:

• How can security teams coordinate an incident response when they can't trust their organization's infrastructure?
• What if AI could actively investigate evidence and help responders understand an attack as it unfolds?

That's why we built AEGIS.

We wanted to create more than another security dashboard. Our goal was to build an independent command center where AI assists with investigations, teams can collaborate securely, and every important decision is supported by evidence.

What It Does

AEGIS brings incident investigation, communication, documentation, and recovery into one platform.

When a cyberattack is reported, responders can create an incident, document what they know, and begin investigating affected systems. From there, AEGIS helps teams understand what's happening and decide what to do next.

1. AI-Powered Incident Investigation

Instead of requiring responders to manually examine every suspicious record or log, AEGIS uses an AI investigation agent to help uncover potential threats.

The agent analyzes evidence from simulated databases, account activity, network logs, and business systems. It looks for unexpected changes, unusual behavior, and connections between suspicious events.

For example, imagine an administrator account suddenly shows unusual activity. Around the same time, several customer records are modified.

AEGIS can:

• Detect the unusual account activity.
• Identify which records were changed.
• Investigate whether the events might be connected.
• Explain the suspicious behavior and link it to supporting evidence.
• Recommend findings for a security responder to review.

The important distinction is that AI doesn't make the final call. It can investigate and suggest findings, but responders must review the evidence before confirming a compromise.

As new information becomes available, the agent can continue investigating and identify additional threats.

2. Context Graph and Compromised Data Tracking

Knowing that a system was attacked isn't enough. Responders also need to understand exactly what was affected.

AEGIS uses an interactive Context Graph to show relationships between users, accounts, systems, databases, individual records, and security findings.

For example, if an attacker gains access to a customer database, AEGIS helps responders explore which records may have been exposed or modified.

It also tracks different types of impact:

• Encrypted: Data may be locked by ransomware.
• Exfiltrated: Evidence indicates data may have been stolen.
• Modified: Records were changed unexpectedly.
• Deleted: Information was removed.
• Unavailable: Systems or data cannot currently be accessed.

These distinctions are important because an encrypted database doesn't necessarily mean its contents were stolen.

AEGIS helps responders separate confirmed damage from suspected threats and information that still needs investigation.

3. Independent Security and Team Communication

During a cyberattack, an organization's normal login and messaging systems may no longer be trustworthy.

AEGIS is designed to operate independently of those systems.

It maintains its own authentication and access controls, allowing administrators to invite responders, assign permissions, and revoke access without relying on compromised corporate accounts.

The platform also includes built-in communication tools:

• Incident-specific team messaging.
• Direct messages between responders.
• Investigation tasks and assignments.
• Urgent alerts and paging.
• Automatic escalation to a backup responder when urgent pages go unanswered.

This gives teams a dedicated place to coordinate their response, even when their normal workplace tools are unavailable.

4. Business Impact and Recovery

A cyberattack doesn't just affect technology. It can interrupt entire business operations.

AEGIS connects security findings to the business processes that depend on affected systems.

For example, if a customer database is potentially compromised, the platform can identify customer-support operations that may no longer be safe to perform.

AEGIS can then recommend predefined recovery procedures and help responders track their progress.

Sensitive recovery actions require approval from authorized team members. The AI can recommend what to do, but it cannot independently execute critical recovery decisions.

For our demonstration, we also implemented simulated recovery workflows. If a recovery attempt fails, AEGIS can suggest a restricted fallback that uses independently stored synthetic data to keep essential operations running.

5. Live Incident Documentation and Reporting

During an active incident, documentation is often scattered across messages, spreadsheets, and separate reports.

AEGIS keeps everything organized in one place.

The platform maintains a live incident timeline containing:

• Security findings and supporting evidence.
• Affected systems and data.
• Investigation updates.
• Responder decisions and actions.
• Recovery progress.

AEGIS can also generate executive summaries and detailed incident reports using information already collected during the response.

Our reporting structure incorporates concepts from industry frameworks such as NIST, VERIS, MITRE ATT&CK, and forensic evidence documentation practices.

Reports distinguish between confirmed, suspected, and unknown information. Previous report versions are preserved as new evidence becomes available.

Demo scope: Our application uses synthetic incident data, simulated security connectors, and simulated infrastructure recovery. The investigation engine, AI tool usage, access controls, real-time collaboration, workflow tracking, and report generation operate within the actual application.

How We Built It

We built AEGIS as a full-stack application using Next.js, React, TypeScript, and SpacetimeDB.

We wanted the platform to support real-time collaboration while keeping the AI investigation system separate from sensitive administrative and recovery operations.

Frontend

We used Next.js, React, TypeScript, Tailwind CSS, and shadcn/ui to build the interface.

The application includes an incident dashboard, investigation workspace, communication tools, recovery workflows, and reporting features.

We also used React Flow to build the interactive Context Graph, allowing responders to explore relationships between compromised systems, accounts, and records.

Backend and Real-Time Updates

SpacetimeDB serves as our primary database and real-time synchronization layer.

When a responder updates an incident, confirms a finding, or sends a message, those changes become visible to other authorized team members without requiring a page refresh.

AI Investigation Agent

We built a custom TypeScript AI agent with specialized investigation tools.

The agent can:

• Examine collected security evidence.
• Compare database records across different points in time.
• Detect predefined anomalies.
• Explore relationships between suspicious events.
• Propose new findings with supporting evidence.

One important design decision was separating tasks that require exact results from tasks that benefit from AI reasoning.

Traditional code handles record comparisons, hashes, counts, and anomaly checks. The AI uses those results to investigate potential connections and determine what evidence to examine next.

Before presenting findings, AEGIS also checks that the referenced evidence exists and supports the observations being reported.

Security and Testing

Because AEGIS is intended for compromised environments, security was a major consideration throughout development.

We implemented independently managed accounts, hashed passwords, protected sessions, private database tables, and backend permission checks.

The investigation agent also operates with restricted permissions. It cannot approve recovery actions or grant administrative access.

We used Vitest and Playwright to test incident workflows, permissions, real-time updates, and application behavior.

Challenges We Ran Into

1. Making AI Findings Reliable

One of our biggest challenges was preventing the AI from treating suspicious activity as confirmed evidence of an attack.

For example, an unusual network transfer could indicate data theft, but it doesn't prove which records were stolen. Similarly, a modified database record isn't automatically malicious.

We addressed this by separating raw evidence, AI-generated proposals, and human-confirmed findings.

Every proposed finding must reference supporting evidence, and responders must verify it before it becomes part of the official incident record.

2. Building for Compromised Environments

AEGIS needed to remain useful even when an organization's normal systems couldn't be trusted.

This meant implementing independent authentication, carefully restricting access to incident information, and ensuring the AI agent couldn't bypass security rules.

We also had to support background investigations that could continue after a browser was closed while respecting changes to user permissions.

3. Handling an Investigation That Never Stands Still

Cybersecurity incidents constantly evolve.

New evidence can reveal additional affected systems or challenge conclusions made earlier in an investigation.

We needed a way to keep findings up to date without losing the original evidence and decisions.

AEGIS preserves incident history while allowing new information to trigger additional investigations and updated findings.

4. Keeping the Interface Simple Under Pressure

Our platform combines investigation, communication, compromised data tracking, recovery, and reporting.

The challenge was presenting all these features without overwhelming someone responding to an active attack.

We focused the main dashboard on incident status and immediate priorities, while keeping detailed AI analysis in a separate Investigation workspace.

This allows responders to quickly understand what needs attention and investigate further when necessary.

Accomplishments That We're Proud Of

1. Building an AI agent that actually investigates.

Rather than displaying prewritten security alerts, AEGIS processes synthetic evidence, detects changes, and uses specialized tools to investigate possible threats.

2. Making every AI finding traceable.

Our agent links proposed findings to the records and observations behind them, giving responders the information they need to verify its conclusions.

3. Tracking compromised data beyond the system level.

Our Context Graph allows responders to investigate individual records and distinguish between possible exposure, unauthorized changes, and confirmed impact.

4. Connecting investigation directly to response.

Security findings can lead to investigation tasks, business-impact warnings, recovery recommendations, and updated incident reports.

5. Keeping humans in control.

AI helps investigate and recommend actions, but it cannot independently confirm compromises, approve sensitive recovery operations, or change administrative permissions.

6. Preserving the complete incident history.

AEGIS maintains evidence, decisions, and report versions as investigations evolve, helping teams understand not only what happened but how their understanding changed over time.

What We Learned

Building AEGIS taught us that creating an effective AI agent involves much more than connecting an LLM to an application.

The difficult part is giving the agent reliable tools, useful information, clear permissions, and a way to explain its conclusions.

We learned that traditional code and AI reasoning work best when they handle different responsibilities. Code is better suited for exact comparisons and calculations, while AI can help investigate patterns and connections across multiple sources.

We also gained a better understanding of how uncertain cybersecurity investigations can be. Suspicious activity doesn't always indicate a successful attack, and restoring a service doesn't necessarily mean it's safe to use again.

Most importantly, we learned how critical user experience becomes during an emergency.

Even a technically powerful platform needs to make the next action obvious. Responders shouldn't have to spend valuable time figuring out how to use their tools while an attack is unfolding.

What's Next for AEGIS

Our next goal is to move beyond simulated incidents and evaluate AEGIS in more realistic environments.

We plan to:

1. Expand AI investigations: Test the agent against more complex attack scenarios and improve how it connects evidence.
2. Integrate real security tools: Add verified, read-only connections to external security data sources.
3. Improve recovery workflows: Expand the library of predefined recovery procedures and approval processes.
4. Strengthen security: Continue improving isolation, access controls, and evidence-handling practices.
5. Test with real responders: Gather feedback from cybersecurity professionals to improve the platform's usability during active incidents.

Ultimately, we want AEGIS to become a dependable environment where security teams can investigate incidents, coordinate their response, and make informed decisions—even when the infrastructure around them has been compromised.

Built With

TypeScript, Next.js, React, Node.js, SpacetimeDB, OpenAI API, custom AI agent runtime, structured tool calling, Zod, Tailwind CSS, shadcn/ui, Radix UI, React Flow, Vitest, and Playwright.

Built With

• next.js
• node.js
• openai
• radix-ui
• shadcn/ui
• spacetime
• tailwind-css
• typescript
• zod