CleanRoom

Inspiration

During a cyberattack, company would normally reach out for emails, phones, internal chats, which may be compromised or unavailable. Responders need a place to coordinate, establish the facts, and make decisions under pressure.

We wanted to target a less visible problem: a decision can be wrong and outdated once new evidence and findings arrive. CleanRoom connects that evidence to the assumptions behind a decision, helping teams recognize when their plan needs another look.

What it does

CleanRoom is a cyber incident command center that brings incident documentation, affected systems and data, team communications, and decision review into one workspace.

Responders submit findings in plain language. NVIDIA Nemotron investigates them through a multistep workflow, retrieving related evidence, assumptions, and decisions before suggesting a review or verification step. Suggestions include supporting sources and remain subject to human approval.

Team members can discuss findings, assign follow up actions, and acknowledge responsibilities in real time. Responders can also dismiss suggestions and provide optional feedback for reassessment.

How we built it

We built the frontend with React, TypeScript, Vite, and Tailwind CSS. SpacetimeDB powers the shared incident state, backend operations, and real 'time updates.

A server side TypeScript service connects to Nemotron and provides tools for retrieving incident context and proposing reviews. We separate AI suggestions from human findings and approved decisions.

Our local demonstration uses separate authenticated browser sessions connected to the same backend to show collaboration between an analyst and an incident commander.

Challenges we ran into

One challenge was defining the boundary between AI assistance and human authority. We wanted Nemotron to investigate and suggest useful next steps without treating uncertain observations as confirmed facts.

Another was simplifying the interface. Incident response involves substantial information, but showing everything at once makes it harder to act. We focused on concise summaries, contextual discussions, and details available on demand.

Connecting separate user sessions while preserving incident permissions also required careful integration.

Accomplishments that we're proud of

We brought evidence analysis and human coordination into the same workflow. A finding can lead to an explained review suggestion, a discussion, and an assigned verification action.

We’re especially proud of using Nemotron beyond a chatbot: its role is to investigate relationships between information and decisions. We also designed the experience around uncertainty, keeping reported observations, AI interpretations, and human decisions distinct.

What we learned

Effective incident response depends on shared understanding as much as technical information. Teams need to know what changed, why it matters, and who owns the next action.

We learned that useful AI assistance requires relevant tools, source references, and clear limits. We also learned that a focused, understandable workflow communicates more value than a dashboard filled with features.

What's next for CleanRoom

We want to strengthen and independently test our security controls, validate deployment options outside compromised corporate infrastructure, and expand support for evidence formats.

Future improvements include richer incident report exports, tracking how changes in source trust affect decisions, and testing the workflow with incident-response professionals.