ReCyra AI

A GPT‑5.6 Sol powered security analyst that simulates proposed changes before they happen-showing risk impact, evidence, and the safest next action.

Comment

Inspiration

I started ReCyra with a simple question: what if a security team could test a decision before taking the risk?

Security teams regularly receive requests like “Can we disable MFA for this executive?” or “Can the VPN patch wait another month?” The answer is rarely a clean yes or no. There is usually a trade-off involving exposure, time, business pressure, and possible compensating controls.

Most security dashboards tell us what is happening now. I wanted to build something that could show what might happen next.

What ReCyra does

ReCyra AI is a counterfactual security analyst. You describe a proposed change in normal language, and it simulates the consequences before recommending what to do.

For example, ReCyra can investigate:

  • Temporarily disabling MFA
  • Delaying a critical VPN patch
  • Choosing the best security controls within a limited budget

It compares the current environment, the proposed change, and available mitigations. Instead of returning only a chatbot answer, it shows the attack graph, risk difference, assumptions, evidence, and the tools used during the investigation.

You can also continue the conversation with questions like “What about two weeks instead?” without starting the analysis again.

How I built it

The frontend uses React, TypeScript, Vite, and Cytoscape.js. The backend is built with FastAPI, Pydantic, and NetworkX.

GPT-5.6 Sol runs through the Codex subscription SDK and handles the parts where language and reasoning matter. It interprets the request, selects a structured investigation plan, and explains the final result.

I did not want the model inventing probabilities or financial-loss figures. All risk calculations are therefore performed by a deterministic attack-graph engine. GPT-5.6 Sol decides what needs to be investigated, but the engine calculates the numbers.

The flow works in two model stages. First, GPT-5.6 Sol produces a schema-validated investigation plan. ReCyra then runs the required simulations and comparisons. Finally, GPT-5.6 Sol receives that verified evidence and turns it into an explanation for the user.

The application checks the response again before displaying it. If the scenario changes unexpectedly, the schema is invalid, unsupported numbers appear in the narrative, or the model attempts prohibited activity, ReCyra rejects the response and uses its deterministic fallback.

The local version uses my existing Codex login, so it does not require a separate OpenAI API key.

How I used Codex

I used Codex throughout the project, beginning with turning the initial idea into a realistic implementation plan.

Codex helped me design the boundary between GPT-5.6 Sol and the deterministic engine, implement the backend and interface, write tests, review the security controls, and diagnose problems during integration.

One useful part of the process was asking Codex to audit the finished application against the original plan. That review found gaps that were easy to miss while building, including weak follow-up handling and missing endpoint coverage.

Codex also helped me prepare the demo flow and documentation. It was not just used to produce a block of code at the beginning. It stayed involved through planning, implementation, review, testing, and presentation.

Challenges and lessons

The hardest part was not drawing the attack graph. It was deciding what the model should and should not be trusted to do.

My first conversational flow worked for the prepared prompts, but a follow-up such as “What about two weeks instead?” could lose the original patch-delay context and select the wrong scenario. I had to improve session handling and add evaluation cases for follow-up questions.

I also had to plan for the demo environment. A model response can fail because of authentication, timing, or invalid structured output. ReCyra needed to remain useful in those situations, so I added a clearly labelled deterministic fallback instead of allowing the application to fail silently.

The biggest thing I learned is that building a trustworthy AI tool is less about writing one clever prompt and more about building boundaries around the model. Schemas, deterministic calculations, evidence checks, safe fallback behavior, and realistic tests made the application much more reliable.

The current version passes 33 automated tests and six deterministic scenario evaluations.

What's next

I would like to connect ReCyra to real asset inventories, vulnerability scanners, identity systems, and control telemetry. That would allow the simulations to represent an organization's actual environment instead of curated demo data.

I would also add more scenarios for cloud permissions, ransomware controls, third-party access, and incident-response decisions.

My longer-term goal is simple: before approving a risky security exception, run it through ReCyra first, where OpenAI’s GPT models helps turn the evidence into a clear decision.

Built With

Share this project:

Updates