InoculAI

Inspiration

Social engineering remains one of the most effective cybersecurity threats because it targets people, not just systems. A suspicious message may contain no malware at all—it may simply create urgency, authority, fear, or curiosity and persuade someone to make a dangerous decision. We wanted to build a tool that does more than label a message as “safe” or “scam.” InoculAI was created as a defensive cybersecurity workspace that helps people understand why a message is suspicious and practice responding under pressure through safe, fictional rehearsal.

What it does

InoculAI combines scam detection, campaign analysis, and security education in one workspace. Its SENTINEL classifier evaluates synthetic messages for scam indicators and prompt-injection attempts, then explains the evidence behind its assessment. The platform extracts a “Scam DNA” profile containing social-engineering tactics, tactic chains, inert indicators of compromise, and campaign relationships. Its TRAIN ME simulator presents bounded fictional scenarios that teach users to pause, independently verify information, and recognize manipulation, followed by an immunity report based on the tactics observed. InoculAI never contacts real scammers, sends messages, opens links, performs transactions, or handles real credentials.

How we built it

Python 3.11+
FastAPI and Uvicorn
Pydantic contracts
SQLite for local persistence and model-result caching
HTTPX for Featherless API calls
Pytest for automated tests
Plain HTML, CSS, and JavaScript for the local frontend

Challenges we ran into

A major challenge was balancing useful detection with responsible uncertainty management, since scam language is highly context-dependent and an overly aggressive classifier can create false alarms. We addressed this through conservative classification, explicit evidence, structured explanations, and review states rather than treating the system as an unquestionable authority. We also had to design the project so that cybersecurity training could never encourage unsafe interaction with real attackers, live links, or sensitive information, which led us to make the experience fully synthetic and bounded.

Accomplishments that we're proud of

We are proud that InoculAI treats cybersecurity awareness as an interactive skill rather than a one-time warning. The platform connects detection, explanation, and practice, allowing users to inspect a suspicious message, understand the manipulation techniques behind it, rehearse a safer response, and receive a personalized summary of what they learned.

What we learned

We learned that effective security education requires more than accurate detection. A useful system must explain its reasoning in a way that supports a decision, not simply produce a label; showing a tactic chain, such as impersonation followed by urgency and a request for independent verification, can be more valuable than showing a risk score alone.

What's next for InoculAI

We want to expand the scenario library to cover business email compromise, fake support interactions, account-recovery scams, delivery notifications, investment fraud, and more sophisticated prompt-injection attempts while keeping every scenario synthetic and bounded. We plan to improve personalization by tracking recurring mistakes, adjusting scenario difficulty, and providing targeted practice for tactics such as authority impersonation, artificial urgency, emotional pressure, and requests to bypass normal procedures.