-
-
browser
Inspiration
Security responders must act quickly, but a defensive action that contains an attack can also interrupt critical services. Sentinel explores how AI-assisted incident response can be made safer through simulation and independent policy checks.
What it does
Sentinel is an incident-response research and demonstration workspace. Analysts inspect incident evidence and affected assets, compare candidate defensive interventions, review predicted consequences in an isolated digital twin, and apply deterministic authorization policies before simulated execution. The system records verification results and an audit trail.
How it works
The demonstration focuses on credential-backed lateral movement across a workstation and internal host toward a payroll dependency. The dashboard presents the incident evidence and attack path. Candidate interventions are evaluated for their potential security outcomes and business impact. An unsafe intervention can be blocked by policy while an allowed response can be tested in an isolated simulation environment. No production changes are made.
Safety and transparency
The interface distinguishes deterministic fallback from live model inference. A simulation result is not represented as a real production response or a guarantee of security. The system is intended to support explainable decisions and reproducible incident-response experiments.
Challenges and learning
The central challenge is separating a language model's proposal from the authority to perform an action. Sentinel makes simulation, constraint enforcement, verification and auditability explicit parts of the workflow.
Next steps
Further validation of model-grounded proposals, simulation fidelity, policy coverage, reliability and usability will be needed before any production use.
Built With
- css
- cybersecurity
- digital-twin
- fastapi
- html
- javascript
- python
- simulation
