Rakshastra — Autonomous AI Cyber Defense Platform
Rakshastra is an autonomous AI cybersecurity engineer and cyber defense platform built to detect, understand, predict, and respond to modern cyber threats across heterogeneous environments.
Repository: https://github.com/SKYGOD07/Rakshastra
Web Experience: https://rakshastra.vercel.app/
Inspiration
Rakshastra started from a simple observation: most organizations do not suffer from a complete absence of security data. They suffer from the inability to turn a large volume of fragmented security signals into a timely, defensible decision.
Modern attacks move across identities, endpoints, applications, networks, cloud services, messaging systems, and external infrastructure. A single alert rarely tells the whole story. The analyst has to correlate the evidence, determine whether the behaviour is anomalous, identify what threat pattern it resembles, estimate what the attacker may do next, understand which assets are exposed, and then decide what response is safe.
That workflow is slow, fragmented, and heavily dependent on expensive human expertise.
Rakshastra was designed to put an intelligence layer above that fragmented security stack.
The core idea was not to build another dashboard that displays alerts. The goal was to build a system that can progressively answer:
What is happening? Why is it suspicious? What is connected to it? What is likely to happen next? What should the defender do? What will happen if we take that action?
The project therefore evolved around five tightly connected security capabilities:
- Behavioural intelligence to identify abnormal activity rather than relying only on known signatures.
- Threat attribution and attack prediction to map observed techniques to known adversarial behaviour and estimate likely next moves.
- Automated incident response to move from detection toward containment and remediation through controlled playbooks.
- Vulnerability prioritisation to focus limited security resources on the assets and weaknesses that actually matter.
- Cyber-resilience digital twin simulation to test attack paths and defensive changes without touching production infrastructure.
The project then expanded beyond a single security use case. The same intelligence architecture was extended to support entity resolution, multi-source correlation, explainable reasoning, threat-intelligence retrieval, sandboxed execution, structured investigation workflows, and paid API access.
The result is Rakshastra: a security operating layer intended to behave more like an autonomous security engineer than a conventional monitoring console.
What it does
Rakshastra combines multiple security engines into one operating workflow.
1. Behavioural Anomaly Detection / UEBA
The UEBA layer establishes a behavioural baseline for users, hosts, services, and other entities and scores deviations from that baseline.
The system is designed to detect patterns such as:
- unusual authentication behaviour
- abnormal process execution
- network beaconing
- suspicious command execution
- privilege escalation bursts
- abnormal data staging
- multi-phase attack behaviour
- deviations that may not yet match a known malware signature
The important design principle is behavioural intelligence.
An attacker should not need to match a predefined malware signature before the system can consider the activity suspicious.
2. APT Attribution and Threat Intelligence
Rakshastra maps observed tactics, techniques, and procedures against a threat-intelligence knowledge layer based around MITRE ATT&CK concepts and threat-actor profiles.
The current repository describes:
- 40+ threat-actor profiles
- weighted similarity scoring
- technique matching
- confidence scoring
- actor clustering
- attack-pattern analysis
The latest project documentation also describes a hybrid RAG architecture combining semantic retrieval through Qdrant with lexical BM25/SQLite FTS5 fallback for resilient threat-intelligence retrieval.
This allows the system to combine:
Observed telemetry → TTP identification → threat-intelligence retrieval → actor attribution → defensive recommendation
instead of treating every event as an isolated alert.
3. Attack Prediction and Graph Intelligence
Rakshastra models an organization's infrastructure as a graph.
Nodes can represent:
- workstations
- servers
- domain controllers
- identity systems
- applications
- databases
- gateways
- other critical infrastructure assets
Edges represent relationships such as network connectivity, trust, or communication paths.
The graph layer allows Rakshastra to:
- identify possible attack paths
- trace lateral movement
- locate chokepoints
- calculate blast radius
- model compromised downstream assets
- evaluate where a defensive control would break an attack path
The project also contains a prediction layer that uses state-transition/Markov-style modelling to estimate likely next adversarial moves based on the current attack stage.
This changes the security workflow from:
"Something bad happened."
to:
"Something bad happened, this is the probable attack stage, these are the likely next moves, and these are the controls that can interrupt the chain."
4. Autonomous Incident Response / SOAR
The SOAR and incident-response layer turns intelligence into controlled action.
The system includes workflows for:
- alert triage
- investigation
- containment
- escalation
- auto-response
- incident closure
- playbook execution
- dry-run simulation
Potential containment actions include:
- host isolation
- network blocking
- session termination
- credential revocation
- firewall controls
- ransomware containment
- other pre-approved response actions
Rakshastra is designed around safety gates rather than unrestricted automation.
For high-impact actions, the platform can operate in simulation/dry-run mode or require analyst approval.
This is particularly important in critical infrastructure environments where an incorrect automated action can be as damaging as the incident itself.
5. Government / Critical Infrastructure Vulnerability Prioritisation
A vulnerability scanner that merely lists CVEs does not solve the operational problem.
Security teams need to know:
Which vulnerability should we fix first?
Rakshastra's vulnerability prioritisation layer combines:
- CVE information
- CVSS
- EPSS-style exploitability context
- network exposure
- sector/asset criticality
- CERT-In/KEV-style intelligence
- recommended remediation
- organizational context
The output is therefore intended to become a remediation queue rather than a raw vulnerability list.
For a government or critical-sector environment, this means a high-risk externally exposed asset can be prioritised above a lower-risk issue on an isolated internal system.
6. Cyber Resilience Digital Twin
The digital twin is one of the platform's most strategic capabilities.
Instead of testing an attack directly against a production environment, Rakshastra constructs a virtual representation of the organization's security topology.
The operator can:
- model infrastructure
- create attack scenarios
- select an entry point
- simulate attack propagation
- calculate blast radius
- identify chokepoints
- apply hypothetical defensive actions
- compare the resulting topology
Examples include testing controls such as:
- network micro-segmentation
- MFA enforcement
- host isolation
- blocking network edges
- other defensive changes
This supports a what-if security model:
"What happens to the attack if we change this control?"
That turns cyber defence from reactive monitoring into resilience engineering.
7. Multi-Source Correlation and Entity Resolution
Rakshastra also contains a broader intelligence layer capable of correlating identifiers across different sources.
The repository documents extraction and correlation of indicators such as:
- phone numbers
- messaging handles
- domains
- wallet addresses
- URLs
- usernames
- invitation links
- image/profile signatures
- investigation records
The entity-resolution engine can merge aliases into unified profiles and create graph-ready relationships.
This is useful because modern security incidents frequently span multiple systems and identities.
8. Explainable AI
Rakshastra does not treat AI output as an unexplained score.
Its explainable reasoning layer is designed to generate:
- threat summaries
- reasoning chains
- evidence explanations
- counter-evidence
- risk-score breakdowns
- investigator recommendations
- chronological investigation narratives
This makes the system more useful for environments where a security decision has to be defended later.
An analyst should be able to answer:
Why did Rakshastra classify this as high risk?
rather than only seeing:
Risk = 87
9. Sandboxed and Remote Execution
The platform includes controlled execution infrastructure for local, Docker, and SSH environments.
The project also includes security guardrails intended to prevent dangerous actions from being executed blindly.
The execution architecture supports:
- local execution
- Docker sandboxing
- remote SSH execution
- terminal/process tools
- security skills/playbooks
- command safety checks
This lets the AI move beyond analysis into controlled operational assistance.
10. Omnichannel Gateway
Rakshastra includes a gateway architecture intended to connect security operations to messaging and operational channels.
The repository documents adapters for platforms such as:
- Telegram
- Discord
- Slack
- Signal
- Webhooks
- custom API clients
This means the security system can be connected to the channels where analysts already communicate rather than forcing them to remain inside one dashboard.
11. Gemini-First AI Architecture
The current project positions Gemini as the primary AI cognitive layer.
The repository describes a Gemini-first architecture with support for very large contexts and multimodal analysis.
Gemini can be used for:
- reasoning
- structured investigation analysis
- multimodal evidence interpretation
- OCR-derived evidence analysis
- tool selection
- function calling
- report generation
- threat-intelligence synthesis
The AI is therefore not just a chatbot sitting beside the security product.
It is integrated into the operational loop.
12. Algorand x402 Pay-Per-Request Intelligence
Rakshastra has also been developed toward a pay-per-request API model.
The repository contains x402/Algorand middleware for protected endpoints, including:
- transaction ID validation
- Algorand Indexer verification
- payment amount validation
- recipient validation
- replay-attack prevention
- verified transaction storage
- protected API routes
This creates a commercial model where intelligence can be consumed as an API rather than requiring every organization to purchase a large security suite.
That makes Rakshastra potentially useful not only as a product but also as an intelligence platform.
How we built it
Rakshastra was built as a modular, multi-layer security platform rather than as a single monolithic application.
Frontend
The main web experience uses:
- React
- TypeScript
- Vite
- TailwindCSS
- Lucide icons
- D3-style graph visualisation
- interactive operational dashboards
The interface is organized around security workflows rather than generic analytics pages.
The command centre and specialist modules expose the major intelligence engines directly to the operator.
Backend
The backend is Python-based and organized around:
- FastAPI
- Pydantic models
- service/controller/route architecture
- modular intelligence engines
- persistent state
- REST APIs
- WebSocket-capable infrastructure
- platform gateways
The system has separate layers for:
Request → API → Controller → Service → Intelligence Engine → Memory / Execution
This separation allows individual engines to evolve without forcing a rewrite of the entire platform.
Intelligence Layer
The project's current intelligence architecture includes:
- UEBA
- APT attribution
- attack prediction
- graph analysis
- entity resolution
- multi-source correlation
- threat-intelligence RAG
- explainable reasoning
- SOAR
- vulnerability prioritisation
- digital twin simulation
This modular architecture was important because the project repeatedly expanded into new security domains without replacing the original core.
Retrieval-Augmented Generation
The threat-intelligence layer combines semantic and lexical retrieval.
The repository documents:
- Qdrant vector search
- embedding-based retrieval
- SQLite FTS5/BM25 fallback
- CERT-In/CISA intelligence
- organizational security bulletins
This gives Rakshastra a way to combine authoritative security knowledge with organization-specific context.
Graph Intelligence
Graph processing is used in several parts of the system:
- infrastructure topology
- attack paths
- entity relationships
- threat-actor relationships
- blast-radius analysis
- digital twins
This is important because cybersecurity is fundamentally relational.
A compromised machine is not useful information by itself.
The meaningful questions are:
What can it reach?
What trusts it?
What can an attacker reach next?
Which control would break that path?
AI Orchestration
The AI layer is not given unrestricted authority.
The architecture separates:
- reasoning
- tool selection
- execution
- policy
- validation
- audit
That lets Rakshastra operate with different autonomy levels depending on the risk of the action.
Desktop and Deployment
The repository now contains a Windows/Electron desktop direction in addition to the web experience.
The project also supports deployment patterns involving:
- Docker
- remote VPS access
- local execution
- SSH execution
- gateway services
Recent commits show work on remote dashboard binding, gateway bootstrap behaviour, Windows shell compatibility, Linux frontend dependencies, and desktop packaging.
Evolution of the Build
The repository's recent history reflects a rapid progression:
- core intelligence engines
- incident-response APIs
- vulnerability-prioritisation APIs
- digital-twin APIs
- APT attribution and hybrid RAG
- x402 transaction validation
- Gemini-first onboarding
- remote execution
- dashboard restructuring
- desktop packaging
- README and product documentation overhaul
The latest repository state was pushed in August 2026, with the latest commits focused on dashboard integration and large-scale documentation/product refinement.
Challenges we ran into
1. Turning multiple security engines into one product
The hardest problem was not implementing individual engines.
It was connecting them.
A UEBA anomaly needs to become an APT clue.
An APT clue needs to influence attack prediction.
An attack prediction needs to influence SOAR.
A SOAR action needs to be evaluated against the digital twin.
The digital twin needs to feed the next defensive decision.
That forced us to design around a common intelligence pipeline rather than independent features.
2. Keeping AI useful without making it unsafe
Unrestricted autonomous security actions are dangerous.
An AI model can misunderstand telemetry, hallucinate a relationship, or recommend a destructive action in the wrong environment.
We therefore built explicit layers for:
- validation
- simulation
- human escalation
- deterministic checks
- sandboxed execution
- auditability
The goal is not:
"Let AI control the infrastructure."
The goal is:
"Let AI compress the investigation and response loop while preserving control over high-impact decisions."
3. Building a useful graph model
A security graph becomes useless if it is just a visual network map.
The graph needed to answer operational questions:
- What is connected?
- What is reachable?
- Where can an attacker move?
- What is the blast radius?
- What is the chokepoint?
- Which control changes the outcome?
That required both backend graph algorithms and a usable visual interface.
4. Balancing real data with a prototype
A project like Rakshastra requires enterprise telemetry, threat feeds, CVEs, identity information, and infrastructure data.
A hackathon prototype cannot safely depend on privileged production datasets.
The solution was to make the architecture capable of accepting real data while supporting controlled test data and simulation.
That distinction became especially important for:
- UEBA
- SOAR
- digital twin
- threat attribution
- vulnerability prioritisation
5. Keeping the rapidly growing repository maintainable
Rakshastra grew rapidly from an early prototype into a large multi-module project.
The team had to repeatedly deal with:
- duplicate code paths
- repository restructuring
- CI failures
- dependency problems
- Windows/Linux compatibility
- web build issues
- documentation drift
- provider compatibility
- dashboard refactoring
This work was not visible in the final interface, but it was critical to turning a demo into an actual software platform.
6. Building a payment model into a security product
The x402 work introduced another engineering challenge.
The platform had to distinguish between:
- normal API requests
- protected intelligence endpoints
- valid payments
- invalid payments
- replayed transactions
- insufficient payments
The transaction had to be validated before the protected intelligence service was allowed to execute.
That required payment middleware, transaction persistence, Indexer verification, and replay prevention.
Accomplishments that we're proud of
1. We transformed the idea into a complete security platform
Rakshastra is no longer a single cybersecurity feature.
It is a platform combining:
UEBA + APT Intelligence + RAG + Graph AI + Attack Prediction + SOAR + Vulnerability Prioritisation + Digital Twin + Explainable AI
inside one operational system.
2. Five major cyber-resilience engines were implemented
The project directly addresses five major operational problems:
- behavioural anomalies
- threat attribution/prediction
- incident response
- vulnerability prioritisation
- cyber-resilience simulation
This gave the platform a full lifecycle rather than a single-point feature.
3. We built an actual intelligence-to-action workflow
The most important architectural achievement is that the engines can work together.
The intended flow is:
Telemetry
↓
Anomaly
↓
Threat Intelligence
↓
Attribution
↓
Attack Prediction
↓
Risk
↓
Response
↓
Simulation
↓
Defensive Improvement
That is fundamentally more useful than an alert-only security dashboard.
4. We moved beyond a prototype dashboard
The latest repository contains:
- a web command centre
- specialist security pages
- REST APIs
- gateway integrations
- CLI/TUI interfaces
- Windows desktop packaging
- remote execution support
- payment middleware
- retrieval infrastructure
- persistent investigation state
This represents a substantial jump from the original prototype.
5. We built toward commercial use
One of the most important milestones for the project was proving that Rakshastra could move beyond a purely academic or hackathon demonstration.
According to the project team's account, Rakshastra generated ₹21,000 through a paid deployment/implementation engagement with the Cyber Cell in Gwalior.
We treat that as a major validation point.
The significance was not simply the ₹21,000.
The important signal was that the system was compelling enough to move from:
"Here is our prototype."
to:
"This can be deployed and used as a security tool."
That experience also changed the direction of the product.
Instead of building only for competitions, the project began being treated as an actual security product with:
- deployment requirements
- operator workflows
- access controls
- remote access
- auditability
- documentation
- monetization
- API consumption
- desktop distribution
6. We built an architecture that can keep evolving
The project has already crossed several domains without abandoning its foundation.
The same core architecture has supported:
- cyber investigation
- threat intelligence
- behavioural analytics
- national-infrastructure resilience
- incident response
- intelligence APIs
- payment-backed services
That flexibility is one of Rakshastra's strongest assets.
What we learned
1. Cybersecurity is a correlation problem
The most important lesson was that useful security intelligence rarely comes from one signal.
The value comes from connecting weak signals.
One unusual login may be harmless.
One unusual process may be harmless.
One suspicious DNS request may be harmless.
Together, with the right context, they can indicate an attack.
Rakshastra was therefore designed around correlation rather than isolated alerts.
2. AI must be grounded in deterministic systems
Large language models are excellent at:
- interpreting evidence
- summarizing investigations
- reasoning over large contexts
- producing structured recommendations
But they should not be trusted to invent the underlying security facts.
The strongest architecture therefore uses AI together with:
- statistical scoring
- graph algorithms
- rules
- structured schemas
- RAG
- deterministic validators
- security policies
The AI reasons over verified signals instead of replacing them.
3. Explainability is part of security, not just a UI feature
A risk score without explanation is difficult to trust.
Investigators and security teams need to understand:
- what triggered the alert
- what evidence supports it
- what contradicts it
- how confidence was calculated
- what action is recommended
- what could happen if that action is executed
This led directly to the explainable reasoning architecture.
4. Automation requires boundaries
The project taught us that autonomous security is not the same thing as unrestricted automation.
Safe autonomy needs:
- permission boundaries
- simulation
- approval gates
- sandboxing
- replay protection
- deterministic verification
- audit logs
The right target is controlled autonomy.
5. Product design matters as much as the engine
A technically impressive security engine can still fail if an analyst cannot understand it in ten seconds.
This drove the design of the current command-centre experience.
Every major engine is now represented as an operational workflow rather than only an API.
6. Deployment changes the engineering priorities
Once a system is intended for real organizations, priorities change.
Things that looked secondary during prototyping become essential:
- remote access
- authentication
- packaging
- environment management
- logs
- CI
- reproducibility
- installation
- rollback
- documentation
The project's later commits reflect this shift.
What's next for Rakshastra
Rakshastra is now moving toward a production-oriented security platform rather than remaining a competition prototype.
1. Deeper live integrations
The next major step is connecting Rakshastra to real enterprise telemetry:
- SIEM
- EDR
- NDR
- identity platforms
- cloud environments
- system logs
- endpoint events
- network telemetry
- threat-intelligence feeds
This will allow the behavioural engines to operate continuously rather than primarily through test and simulation data.
2. Full security-operations deployment
The goal is to package Rakshastra so an organization can install it, configure it, connect telemetry sources, and begin operating without reconstructing the project manually.
That includes:
- Windows desktop distribution
- Linux/server deployment
- Docker-based deployment
- remote infrastructure support
- automated configuration
- health monitoring
- upgrade mechanisms
3. Stronger enterprise security controls
The production roadmap includes:
- role-based access control
- stronger authentication
- granular action permissions
- investigation audit trails
- evidence export
- secure credential storage
- stronger secrets management
- formal data-retention policies
4. Expand the digital twin
The digital twin will evolve from a demonstration environment into a serious cyber-resilience planning tool.
Future capabilities include:
- larger infrastructure graphs
- more realistic attack-path models
- defensive optimization
- control cost estimation
- scenario comparison
- resilience scoring
- security investment analysis
5. Expand the autonomous SOC
Rakshastra's long-term goal is to behave like a continuously available AI security team.
Instead of waiting for an analyst to ask:
"What happened?"
Rakshastra should proactively:
- monitor
- detect
- investigate
- correlate
- explain
- predict
- recommend
- simulate
- and, where authorized, respond
That is the foundation of the project's long-term autonomous security vision.
6. Intelligence as an API
The x402 architecture creates another path for Rakshastra.
Organizations, developers, agents, and security products can consume individual intelligence capabilities as APIs instead of deploying the complete platform.
Examples include:
- threat analysis
- entity correlation
- investigation reports
- risk scoring
- attack prediction
- vulnerability analysis
The long-term objective is to make security intelligence composable and accessible on a pay-per-use basis.
7. The ultimate product vision
The final vision for Rakshastra is not simply to become another security dashboard.
It is to become an AI security operating system capable of turning raw security telemetry into:
Detection → Understanding → Prediction → Decision → Simulation → Response → Learning
while maintaining human control, explainability, and auditability.
Project Evolution at a Glance
The repository history shows how the platform reached its current form.
Initial intelligence foundation
The project developed:
- entity resolution
- correlation
- explainable reasoning
- graph intelligence
- investigation orchestration
Cyber-resilience expansion
The platform then added:
- UEBA
- APT attribution
- SOAR
- vulnerability prioritisation
- digital twin simulation
Productization
The project subsequently added:
- REST APIs
- Gemini-first onboarding
- Algorand x402 payment validation
- remote SSH execution
- remote dashboard access
- Windows/Electron packaging
- gateway integration
- deployment improvements
Latest repository direction
Recent repository commits show a continued shift toward product maturity, including:
- major dashboard integration and refactoring
- comprehensive README and architecture documentation
- APT attribution and hybrid RAG
- cyber-resilience digital twin
- government vulnerability prioritisation
- autonomous incident response
- remote execution support
- x402 transaction validation
- desktop packaging
The repository metadata currently points to the public web experience and shows the project as an active public repository. The most recent pushes were made in August 2026.
Commercial Validation
The most important external validation reported by the team is the ₹21,000 paid engagement with the Gwalior Cyber Cell.
This represented the point at which Rakshastra stopped being treated purely as a prototype and started being treated as a deployable security solution.
The commercial lesson was important:
A security organization does not buy a dashboard.
It buys a reduction in investigation time, better situational awareness, stronger prioritisation, safer response, and a platform that can grow with its operational needs.
That principle now drives the product strategy.
Final Positioning
Rakshastra is an autonomous AI cyber defense platform that combines behavioural analytics, threat intelligence, APT attribution, attack prediction, graph AI, SOAR automation, vulnerability prioritisation, digital-twin simulation, explainable reasoning, and intelligence APIs into one security operating system.
The long-term objective is to compress the security lifecycle from:
Alert → Manual Investigation → Manual Decision → Manual Response
into:
Detect → Correlate → Explain → Predict → Simulate → Respond
with AI operating at machine speed while humans retain control over consequential decisions.
Technical Source Note
This write-up was prepared against the current public GitHub repository and its recent commit history. Recent repository changes include dashboard integration, the five cyber-resilience modules, hybrid APT/RAG work, x402 transaction validation, remote execution, desktop packaging, and documentation/product overhauls. The repository README also currently describes Gemini-first AI, Qdrant RAG, Algorand x402, UEBA, SOAR, graph intelligence, digital twin simulation, and sandboxed execution.
The linked Vercel site was also checked as part of the review request; the live page could not be fetched from the current browsing environment because the deployment returned a cache/network fetch error. The repository itself confirms the Vercel site as the project's homepage.
Log in or sign up for Devpost to join the conversation.