DigitalArmor

Security scanners speak jargon. We built one that speaks nonprofit. Our deterministic scanner finds the risks and an LLM explains them in plain language for whoever has to fix them, IT staff or none.

Comment

Inspiration

60% of nonprofits have been hit by a cyberattack in the last two years, yet the vast majority have zero dedicated IT staff. When they run traditional security scans, they are handed a grade (yes- like A, B, C) and an overwhelming amount of technical information. The result is they don't know how to act on it, so don't.

As a recent IT graduate searching for systems administration roles, I spent the last month spinning up and hardening virtual private servers. I quickly realized two things: cybersecurity requires deep, continuously updated knowledge, and resource-strapped nonprofits are without a doubt going to keep getting left behind. I built DigitalArmor because the bottleneck isn't DETECTION it's TRANSLATION. We needed a tool that bridges the gap between elite security expertise and the volunteer-run organizations defending our communities.

How we built it

The Infrastructure: To rigorously test the tool, I spun up a live DigitalOcean VPS under my domain digitalfern.xyz and configured two distinct A records: weak.digitalfern.xyz (intentionally misconfigured and vulnerable) and harden.digitalfern.xyz (hardened to production standards) to prove our scanner's accuracy.

The Scanner: Built using Python, the core engine executes multi-layered checks across HTTP Headers (HSTS, CSP, server disclosure), TLS/SSL (expiry, weak protocols), and DNS/Email hygiene (SPF/DMARC).

AI Translation Layer: Powered by Gradient AI on DigitalOcean, the LLM is strictly sandboxed. An output schema prevents the AI from ever calculating or altering risk scores. AI only translates scores.

Challenges we ran into

Integrating a community-driven "schema" system presented a massive risk: if enthusiasts could submit custom logic, it meant executing unknown, arbitrary code against target websites. Luckily, this risk was realized before coding so we made a design choice based on it. We intentionally made user profiles a pure, static config file enforced by a strict, hardcoded whitelist, completely eliminating the risk of remote code execution vector.

Additionally, introducing an LLM opened up prompt-injection vectors if a malicious site embedded instructions in its HTML. We solved this by strictly limiting what was passed to the LLM (our scanner's data= specific dates or header names) completely isolating the AI from raw HTTP response bodies.

Accomplishments that we're proud of

Live infrastructure validation was very time-consuming but worth it for the demo. Building, deploying, and testing the platform against our live .weak and .hardened subdomains prove real-world detection.

Severity ratings are assigned exclusively via a static lookup table in Python. Because the LLM's data structure completely lacks a severity field, it is impossible for the AI to hallucinate or misrepresent the criticality of a threat.

Designing a safe ecosystem where novice, junior, and senior security analysts can contribute schemas to build a verified public portfolio for employers, while AI handles the heavy lifting of interpreting those custom schemas so nonprofits can actually understand them.

What we learned

We learned that the most responsible way to use AI in cybersecurity is to keep it away from the judgment seat. AI should never decide your risk score; it should only ensure you understand it.

I also learned that being an amateur isn't a limitation but a perspective. It forced me to design a system that doesn't just cater to experts, but explicitly creates a pipeline where experts can securely scale their knowledge to protect vulnerable organizations.

What's next for DigitalArmor

DigitalArmor is built to scale into a thriving ecosystem. Next, we want to mature our conceptual Pending-Schemas Review Pipeline into a fully realized, peer-reviewed hub where senior security engineers can audit and approve community-submitted check profiles.

Built With

Share this project:

Updates