Secoria

Secoria main app
PREVENTIVE DEFENSE - Host Security Assessment
RUNTIME DEFENSE - Incident Investigation
How Secoria works

Inspiration

Security teams often have more alerts than they can investigate. Small teams especially struggle to connect evidence, understand what really happened, fix the underlying weakness, and verify that the risk is actually gone.

Secoria was inspired by a simple idea: instead of relying on one general-purpose model, use a collective of specialized cyber-defense agents that analyze different domains, preserve disagreement, and support a human analyst with evidence-bound conclusions.

What it does

Secoria is a local web-based cyber-defense application with two workflows.

Runtime Defense

Runtime Defense investigates suspicious activity across identity, endpoint, and network evidence.

Specialized agents analyze their own domains, then Secoria correlates their findings without hiding uncertainty or disagreement. The evidence is sealed before GPT-5.6 is used, and the model can only explain and investigate the validated case.

Analysts can ask grounded follow-up questions with citations and limitations, while the final decision remains human-controlled.

Preventive Defense

Preventive Defense assesses isolated Linux hosts over SSH and checks:

packages and known vulnerabilities
SSH configuration
users and privileges
services and exposed ports
firewall state
authentication logs
permissions and scheduled tasks

Secoria creates a staged remediation plan. Users can approve, reject, or defer individual actions, or review an Approve All plan.

After execution, Secoria collects fresh evidence and reassesses the host. It reports what was resolved, what remains, and whether reverting a change reintroduced a vulnerability.

How we built it

Secoria combines:

a Python security engine
a Next.js and TypeScript interface
Docker-based Linux testbeds
controlled SSH execution
deterministic security specialists
sealed evidence packages
constrained GPT-5.6 investigation
approval-gated remediation
rollback, revert, and post-remediation verification

The remediation engine uses validated action types and command templates. GPT-5.6 cannot generate and execute arbitrary shell commands.

Challenges

The main challenges were:

preserving specialist disagreement instead of producing false confidence
preventing the language model from inventing evidence
proving remediation through reassessment rather than command success
safely hardening SSH without locking out the administrator
handling dependency compatibility and rollback
keeping chat read-only and bound to the exact sealed case

What we learned

We learned that trustworthy AI-assisted security requires clear boundaries:

evidence must remain authoritative
uncertainty must remain visible
human approval must be enforced
remediation must be verified
rollback must also be tested
AI should explain and investigate, not silently take control

What is next

The current version is a local research and demonstration platform using isolated Linux testbeds.

Next steps include production Linux host support, a constrained local agent, broader vulnerability intelligence, cloud and Kubernetes integrations, and privacy-preserving learning across organizations.

Our long-term goal is to help small security teams operate with the investigative and defensive depth of a much larger security organization.