AI Security Desk — Project Description

AI Security Desk is an AI-assisted web application security assessment platform designed for small businesses and security teams

Comment

This is a strong project description. For the Build with Gemini / Devpost submission, I would keep the substance but make it more concise, consistent, and clearly emphasize Gemini, AI-native operation, business impact, and the three-agent architecture.

Recommended final version

AI Security Desk

Inspiration

Small businesses increasingly depend on web applications, APIs, and cloud services, but many do not have dedicated security teams. Existing security tools can also generate large volumes of technical findings that are difficult for developers and business owners to understand and prioritize.

This inspired us to build AI Security Desk, an AI-assisted application security platform designed to make security assessment more accessible and actionable.

Our goal is to move beyond simply generating scanner alerts and answer:

What was found, how serious is it, why does it matter, and what should be done next?

What it does

AI Security Desk combines automated security assessment, evidence collection, AI-assisted risk analysis, and security reporting.

The platform is organized around three agents:

1. Scope Agent

Validates the assessment target and authorization before an assessment begins.

2. Passive Security Agent

Performs authorized passive security checks and collects security observations and evidence, including:

  • Security headers
  • Cookie security configuration
  • Information disclosure
  • Web security configuration
  • Potential XSS indicators
  • Potential SQL injection indicators
  • Other application-security observations

3. AI Risk & Report Agent

Uses Google Gemini to transform security evidence into understandable risk analysis.

It assists with:

  • Executive summaries
  • Overall risk assessment
  • Finding prioritization
  • Business impact
  • Remediation recommendations
  • Security report generation

The dashboard presents Critical, High, Medium, and Low severity findings and provides downloadable HTML and JSON reports.

How we built it

AI Security Desk is built with Python and Flask and uses a web-based security dashboard.

The core workflow is:

Authorized Target
       ↓
Scope Agent
       ↓
Passive Security Agent
       ↓
Security Findings & Evidence
       ↓
Google Gemini
       ↓
AI Risk & Report Agent
       ↓
Risk Prioritization
       ↓
HTML + JSON Reports
       ↓
Dashboard

The AI component is designed around Google Gemini through the Google GenAI SDK / Google Cloud environment.

A key design principle is separating security evidence from AI interpretation. A scanner observation is not automatically treated as a confirmed exploitable vulnerability. This allows the system to emphasize evidence, validation, and risk rather than blindly reporting every indicator as a vulnerability.

Challenges

One major challenge was configuring the Python environment across Windows and PyCharm. The system Python installation was initially unavailable from PowerShell while PyCharm was using its own environment. We resolved the dependency and environment configuration issues so the application could run reliably.

We also encountered report-generation issues during development, including an HTML/CSS formatting problem that caused report generation to fail. We corrected the implementation so assessments can produce HTML and JSON reports.

Another important challenge was distinguishing potential indicators from confirmed vulnerabilities.

For example:

  • Reflected input does not automatically prove exploitable XSS.
  • A database error does not automatically prove exploitable SQL injection.

This led us to design the platform around evidence, validation, risk prioritization, and human review rather than treating every scanner observation as a confirmed vulnerability.

Accomplishments

We are proud that AI Security Desk evolved from a basic security-scanner concept into an integrated AI-assisted assessment workflow.

Key accomplishments include:

  • Working Flask security dashboard
  • Scope Agent architecture
  • Passive Security Agent
  • AI Risk & Report Agent
  • Google Gemini integration architecture
  • Severity classification
  • Critical/High finding highlighting
  • Executive risk summaries
  • Business-impact analysis
  • Remediation recommendations
  • HTML security reports
  • JSON security reports
  • Downloadable reports
  • Report history
  • Authorization-first assessment workflow
  • Evidence-based security analysis
  • Small-business-focused security workflow

Most importantly, the platform focuses on turning technical security findings into understandable and actionable information.

What we learned

We learned that building an AI security product requires more than connecting an AI model to a scanner.

The important pipeline is:

Evidence → Context → Risk → Priority → Action

We learned the importance of:

  • Authorization and scope control
  • Evidence-based analysis
  • Separating detection from validation
  • Risk prioritization
  • Clear remediation guidance
  • Human validation of important findings
  • Reliable report generation
  • AI fallbacks when services are unavailable
  • Making security information understandable to non-security users

We also learned that AI is most valuable when it receives structured security evidence and context and helps reason about risk and business impact.

What's next

Our next goal is to evolve AI Security Desk into a stronger AI-operated security service for small businesses.

Planned improvements include:

  • Full Google Cloud/Gemini production integration
  • CVE enrichment
  • CVSS scoring and explanations
  • Stronger XSS and SQL injection validation
  • Authenticated application assessment with explicit authorization
  • AI-assisted finding correlation
  • Historical security trends
  • Security posture scoring
  • Remediation tracking
  • Customer accounts and multi-tenant support
  • Cloud deployment
  • Automated recurring assessments
  • Ticketing-system integration
  • Customer-facing security dashboards

Long-term vision

AI Security Desk gives small businesses an affordable AI-assisted security team that can assess their applications, understand security risks, prioritize what matters most, and produce professional security reports.

One important submission caution

Only claim “Google Gemini integration”, “live production AI”, or specific autonomous capabilities to the extent you can demonstrate them in your submitted application and evidence. Your description is strongest when it clearly distinguishes what is implemented now from what is planned next.

Built With

Share this project:

Updates