Inspiration

Startups often cannot afford a dedicated Chief Information Security Officer (CISO), yet they face the same cybersecurity risks as larger organizations. Founders are expected to understand security frameworks, write policies, identify risks, and prepare for incidents, all while building their business.

We wanted to create an AI-powered virtual CISO that gives startups access to security guidance, assessments, and remediation planning without requiring a full-time security team.

What it does

SecureAgent is a stateful AI agent that helps startups improve their cybersecurity posture.

The agent:

Assesses security maturity using the NIST Cybersecurity Framework (CSF) 2.0
Identifies security gaps and prioritizes risks
Generates tailored security policies
Creates phased remediation roadmaps (30/60/90/180 days)
Tracks implementation progress over time
Maintains persistent organizational context using MongoDB

Unlike a traditional chatbot, SecureAgent remembers company information and security findings across conversations.

How we built it

SecureAgent was built using:

Google Agent Development Kit (ADK)
Gemini 2.5 Flash
MongoDB Atlas
MongoDB MCP Server
Python
Google Cloud Run

The agent uses a structured system prompt based on NIST CSF 2.0 to evaluate startup security programs. Findings, risks, policies, and roadmap items are stored in MongoDB, allowing the agent to maintain state between sessions.

Challenges we ran into

One of the biggest challenges was building a truly stateful agent instead of a simple chatbot.

We needed a reliable way to store assessments, risks, generated policies, and roadmap progress while allowing the agent to retrieve and update that information dynamically. Integrating MongoDB through MCP tools and ensuring the agent could reason over persistent data required significant experimentation.

Deploying the application as a cloud-hosted AI agent while maintaining a smooth user experience was another challenge.

Accomplishments that we're proud of

Built a stateful AI security advisor rather than a simple Q&A chatbot
Implemented NIST CSF 2.0-based security assessments
Added automated policy generation
Created actionable remediation roadmaps
Integrated persistent memory using MongoDB Atlas
Successfully deployed using Google ADK and Cloud Run

What we learned

This project deepened our understanding of AI agents, tool calling, MCP integrations, and persistent memory architectures.

We also learned how security frameworks such as NIST CSF can be translated into practical workflows that help organizations improve their security posture.