Bastion

agent reasoning traces
incident tracker
defensive maneuvers
the main page
live overview
attack summary
agent action logs
rough diagram
actual incidents

Why We Built Bastion

The internet is calling this month "Black October": Railway breached, LiteLLM breached, php2shell, nodejs2shell, http2shell, OpenCode breached, and the list goes on. In the age of AI, it's no longer a question of if you get breached, but when.

Seeing all of this happen in the span of a few weeks got us thinking about what happens after an attacker gets in. Detecting an attack is one thing. Actually stopping it, kicking the attacker out, and making sure the same vulnerability can't be exploited again is another. That's what inspired us to build Bastion.

Meet Your Autonomous Blue Team

Bastion is an autonomous blue team that continuously monitors web applications and responds to attacks while they're still happening. It uses a reverse proxy as a Web Application Firewall (WAF), with Jev classifying incoming HTTP requests as malicious or benign. The moment a suspicious request is detected, Bastion's LLM agent investigates the activity and determines how to respond, acting within seconds rather than waiting for human intervention.

Instead of just blocking the attacker's IP, Bastion can redirect them into a honeypot, terminate compromised sessions, and deploy virtual patches to prevent the same exploit from being used again, even by a different attacker. While the attacker is still trying to exploit the application, Bastion is already working to contain them and close the vulnerability they found. It also provides a live dashboard where developers can monitor attacks, view incident reports, and see exactly what actions Bastion has taken.

What Bastion Pulled Off

We successfully tested Bastion against four major attack types: SQL injection (SQLi), command injection (CMDi), local file inclusion (LFI), and cross-site scripting (XSS). In all four scenarios, Bastion detected the attack, contained the attacker, and deployed a virtual patch within seconds, without a single human having to intervene.

What's even more exciting is what this means for autonomous blue teaming. Instead of developers finding out about a breach after the damage is done, we built a system that can actively fight back while the attack is still happening. Seeing Bastion autonomously identify an exploit, contain the attacker, and prevent anyone else from exploiting that same vulnerability showed us just how much potential there is for AI-driven incident response. We're giving companies a blue team that can react in seconds, even when nobody is watching.

Beyond the Hackathon

We're taking Bastion beyond the hackathon and turning it into a cybersecurity startup. Our focus now is expanding its capabilities, integrating with real-world infrastructure, and getting Bastion into the hands of companies and startups that need it. The goal is to make autonomous blue teaming a practical part of how companies defend themselves.