CyberResilience AI

• 

  Cyber Resilience measuring App

• 

  Resilience Questionaire

• 

  Result-1

• 

  Result-2

• 

  Result-3

Inspiration

Being an aspiring cyber security professional, I chose to make a Cyber Resilient app, that guides small organizations towards the importance of cyber attacks in this increasingly digitized modern world.

What it does

CyberResilience AI helps small organisations see how prepared they are for a cyber attack, based on their own answers. The user enters their organisation's name, sector and size, then answers eight multiple-choice questions on backups, multi-factor authentication, updates, incident planning, staff training, access control, suppliers and how long they could keep operating if systems went down. The app returns a risk level and score, a plain-English summary, strengths, gaps (each with why it matters and a specific recommendation) and a prioritised action plan.

How I built it

• Frontend: React (Vite), hosted on Vercel.
• Backend: Node.js and Express, hosted on Render. It validates input, applies rate limits, and keeps the API key on the server.
• AI: each assessment makes one runtime call to the Nebius Token Factory chat completions API using nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B. The model writes the summary, gaps, recommendations and action plan as structured JSON, which the backend parses and the frontend displays.
• Scoring: each answer option has a score from 0 (best) to 3 (worst). The backend adds them up and sets the risk level (Low, Medium, High or Critical). The model is told the level and the rating of each answer, and it explains them.

Challenges

1. Empty first response. Nemotron Nano reasons before it answers. My first test used a small max_tokens limit, so the reasoning used it all up and the answer came back empty. Raising the limit fixed it.
2. Inconsistent risk levels. When I let the model choose the risk level, it was inconsistent: it rated a mostly strong organisation as High and listed a weak answer as a strength. I moved the scoring into code, so the same answers always give the same level, and the model only explains it.
3. Reasoning on vs off. Nemotron's reasoning can be switched off. Across my test runs, thinking off produced roughly a third of the output tokens, but in the outputs I saved and compared, it left out a gap my prompt required and did not sort gaps by severity. Thinking on included all gaps, sorted correctly. The sample is small, so I run the app with thinking on.

Testing

I tested with fictional organisations only (a charity, a software start-up and a school), checking that the risk level matched the expected score and that gaps matched the weak answers. All my testing cost about one cent on Token Factory.

Limitations

All eight questions are weighted equally, and the risk thresholds are my own first estimate, not an industry standard. The model sometimes adds small details that were not in the answers. The output is guidance based on self-reported answers, not a security audit or compliance certification.

What's next

Saving assessment history in a database, weighting questions by seriousness, and checking that the model's output covers every weak answer, retrying if it doesn't.

Built during the submission period

This project was created from scratch during the submission period (October 2026).

Built With

• agents
• cybersecurity
• express.js
• javascript
• nebius-token-factory
• node.js
• nvidia-nemotron
• react
• render
• vercel
• vite