SurfaceIQ

Homepage
Onboarding Screen
Attack Surface Dashboard Screen
Risk Assessment Report Screen
Comprehensive Security Report Screen

Inspiration

Cyberattacks often begin with publicly available information. Small exposures such as leaked credentials, exposed API keys, misconfigured subdomains, or public GitHub commits may seem minor individually. However, attackers connect these small pieces together to move laterally and escalate access.

We built SurfaceIQ to help organizations see their digital attack surface the way an attacker does — connected, visualized, and prioritized by risk. Instead of reacting after a breach, we wanted to focus on proactive visibility.

What it does

SurfaceIQ is a cybersecurity prototype that visualizes external attack surface exposure.

The system accepts an email address or domain and performs simulated OSINT-based reconnaissance. It surfaces publicly accessible exposure signals such as:

Breach database matches Public repository exposure Domain and subdomain analysis Linked digital accounts

The results are displayed in an interactive attack surface graph. Users can explore asset relationships, view exposure details, and understand potential risk paths.

The system also generates:

An overall risk score Severity categorization (Critical / High / Medium) Prioritized remediation recommendations SurfaceIQ connects scattered digital exposure into actionable security insight.

How we built it

SurfaceIQ was designed and prototyped using Figma Make to simulate a full cybersecurity workflow.

We structured the system into four layers:

Input Layer – Email / Domain submission Analysis Layer – Simulated OSINT aggregation and correlation Visualization Layer – Interactive node-based attack surface mapping Risk Layer – Scoring engine with prioritized recommendations

We focused on building a realistic security dashboard experience that mirrors how attackers perform reconnaissance — through connections and relationships.

Challenges we ran into

One of the biggest challenges was designing a visualization that reflects attacker thinking. Attackers see connections, not isolated vulnerabilities, so the graph model had to clearly show relationships between assets.

Another challenge was balancing technical depth with usability. We wanted SurfaceIQ to feel like a real cybersecurity platform while keeping it intuitive and understandable.

Creating a meaningful risk scoring system without live backend data was also a design and logic challenge.

Accomplishments that we're proud of

Building a fully interactive attack surface visualization prototype

Designing a structured risk scoring and remediation system Creating a realistic cybersecurity dashboard experience Clearly demonstrating how small public exposures can lead to larger compromises

We are especially proud of the attack path simulation concept, which helps defenders think like attackers.

What we learned

Through this project, we learned:

How OSINT contributes to real-world attack chains The importance of visualizing digital exposure How risk prioritization improves security decision-making The complexity of translating cybersecurity concepts into usable interfaces We also gained experience in security-focused product design and structured threat modeling.

What's next for SurfaceIQ

Our next steps include:

Integrating real OSINT and breach intelligence APIs Implementing a secure backend architecture Adding authenticated user accounts and scan history Expanding asset detection capabilities Refining the risk scoring model with real-world weighting

Our long-term goal is to evolve SurfaceIQ into a practical tool that helps organizations proactively reduce their digital attack surface before exploitation occurs.