Nexus-Sight

Inspiration

Traditional cybersecurity often analyzes threats in isolation: an alert on a server, a suspicious log on an account. However, in real-world infrastructure, the true danger lies not in the compromised node itself, but in what it is connected to. We wanted to build a solution that didn't just see the data, but understood the matrix of relationships. We were inspired by the need to democratize graph topology analysis, enabling any security team to detect attack vectors (such as lateral movements) without needing to be experts in complex query languages like Cypher.

What it does

Nexus-Sight is an autonomous network intelligence and visibility agent. It acts as an intelligent bridge between a graph database (Neo4j) and an advanced language model (Gemini). The agent autonomously extracts the complete topology of a network (nodes, states, and relationships), analyzes it in real-time, and issues a security diagnosis. It is capable of identifying critical threats—such as a compromised server with direct access to a main database—and generating an immediate action plan for containment and mitigation.

How we built it

We developed the agent's core using Python. The architecture is divided into two main components:

Topology Module: We used the official neo4j driver to establish a secure local connection and inject/extract the network structure using Cypher queries.
Reasoning Engine: We integrated the google-genai SDK using the Gemini 3.6-flash model. We extract the graph database topology as JSON and dynamically inject it into the agent's context through structured prompt engineering, allowing it to reason about the graph without hallucinations.

Challenges we ran into

Evolving API Integration: We had to quickly adapt our code to the new Google GenAI API structures to avoid Automatic Function Calling warnings.
Network Fault Tolerance: During development, the model servers experienced massive traffic spikes (503 and 404 Errors). We implemented a robust error handling block using google.genai.errors to ensure the script never crashed and elegantly kept protocols on standby.
Translating Graphs for LLMs: Making a language model understand the directionality of a graph (e.g., Server Alpha -> CONNECTED_TO -> Server Beta) required optimizing Cypher queries so the output was a clean and semantically clear data dictionary for Gemini.

Accomplishments that we're proud of

We managed to get the agent not only to describe the network but also to issue precise value judgments (classifying the risk as "CRITICAL") and understand the concept of "lateral movement" based purely on reading the graph's edges. Seeing the system detect the anomaly on its own was incredible.

What we learned

We proved the immense power of combining graph databases with generative AI. LLMs are excellent reasoners, but when provided with the structured and deterministic context of a graph, their responses evolve from simple generative text into precise, actionable engineering diagnostics.

What's next for Nexus-Sight

We want to expand the agent's capabilities so that it not only detects vulnerabilities but can also execute mitigation commands autonomously (e.g., sending instructions to the firewall to isolate the compromised node). Additionally, we plan to integrate Graph Neural Networks (Node Embeddings) to detect topological anomalies invisible to the human eye.