PhishGuard AI - Fraud & Threat Response Agent

• 

  Threat Analysis Breakdown

• 

  Dual API Architecture Diagram

• 

  Executive Brief Dashboard

Inspiration

Modern cybersecurity threats have evolved beyond traditional email phishing. Today, attackers leverage multi-vector strategies—from deceptive SMS lures (SMiShing) and LLM prompt injection attacks to malicious serial payloads executing via compromised hardware microcontrollers. Existing security solutions are often fragmented and slow, creating a delay between threat detection and executive triage. We built PhishGuard AI to unify threat evaluation across these vectors into a single, sub-second diagnostic interface that automatically translates technical findings into executive-ready incident response reports.

What it does

PhishGuard AI operates as an autonomous cybersecurity triage agent:

• Multi-Vector Threat Analysis: Evaluates email/SMS scams, prompt injection payloads, and hardware serial logs.
• Instant Risk Scoring: Provides real-time percentage-based risk scores along with severe threat indicators (SAFE, SUSPICIOUS, DANGEROUS, CRITICAL).
• Vulnerability Breakdown & Actionable Guidance: Generates clear explanations of underlying security flaws alongside immediate remediation steps for sysadmins and end-users.
• Executive Incident Response Reporting: Leverages deep-reasoning LLM models to automatically compile enterprise-grade incident reports downloadable as formatted Markdown files.

How we built it

• Frontend Dashboard: Developed using Streamlit for an intuitive, low-latency UI.
• Threat Engine: Powered by the Groq API (openai/gpt-oss-20b) for sub-second, high-throughput payload classification.
• Executive Report Engine: Integrated with the ProjectAAL API (featherless/deepseek-v3) featuring custom 60-second timeout handling to execute structured forensic reasoning.
• Environment & Language: Built with Python 3.10+ using python-dotenv for secure local configuration and API secret management.

Challenges we ran into

Integrating dual LLM pipelines with differing latency profiles posed a key challenge. While Groq delivers sub-second results for real-time analysis, deep incident report generation required structured formatting from DeepSeek-v3 via ProjectAAL. Ensuring robust timeout handling and fallback mechanics during high API load was essential for maintaining continuous dashboard stability.

Accomplishments that we're proud of

• Achieving real-time threat detection with sub-second execution across multiple complex threat vectors.
• Seamlessly bridging technical threat logs with executive decision-making via automated incident reports.
• Building a secure, clean, and production-ready codebase with robust error handling.

What we learned

We gained valuable experience in orchestrating multiple specialized LLM APIs for specific tasks (high-speed threat classification vs. deep-reasoning reporting), optimizing API request timeouts, and structuring user-friendly security diagnostic dashboards.

What's next for PhishGuard AI

• Automated Webhook Alerts: Direct integration with Slack and Microsoft Teams for instant SOC team notifications.
• API Endpoint Deployment: Exposing RESTful endpoints for integration into enterprise SIEM platforms.
• Broader Payload Inspection: Expanding analysis to binary executable attachments and embedded PDF link graphs.

Built With

• ai-agent
• cybersecurity
• deepseek-v3
• groq
• llm
• phishing-detection
• python
• streamlit