ThreatLens — AI Security Copilot for Startups

An AI-powered SOC copilot that monitors security logs in real-time, translates telemetry into plain English, and provides 1-click threat mitigation for growing startup teams.

Comment

💡 Inspiration

Early-stage startups and solo founders cannot afford a dedicated SOC (Security Operations Center) analyst ($150k+/year) or complex enterprise SIEM platforms like Splunk. Yet, a single unmitigated ransomware attack or credential stuffing breach can destroy a startup before it hires its first employee.

We were inspired to build ThreatLens — an AI-powered conversational security copilot that works like having a senior security architect on your team 24/7. It listens to system telemetry, analyzes security logs, and allows non-security founders to mitigate threats in 1-click.

🛡️ What It Does

ThreatLens turns complex security logs into actionable, plain-English insights:

  • 💬 Conversational Security Copilot: Ask questions like "Are there any suspicious off-hour logins?" or "How do I contain ransomware on host-01?"
  • 🛡️ 1-Click Threat Mitigation: Instantly block malicious IPs and isolate compromised host endpoints directly from the threat dashboard.
  • 🏷️ MITRE ATT&CK Mapping: Automatically categorizes threat vectors into standardized tactics and techniques (e.g., T1486 Data Encrypted for Impact).
  • 👑 SOC2 Evidence Export: Generates structured CSV audit trails of every automated tool call for compliance audits.
  • ⚡ Tier Advantage Matrix: Free plan for solo founders, with scalable tiers for growing startup teams.

⚙️ How We Built It

ThreatLens is built as an AI-Native Agentic Application:

  1. Frontend: React 18, TypeScript, and Vite featuring a Cyber Glassmorphic SOC UI with interactive 360° laser threat radars and ambient mesh glows.
  2. Backend & Cloud Services: Node.js / Express API deployed on Google Cloud Run, with frontend static assets hosted on Firebase Hosting.
  3. AI Core & Function Calling: Powered by Google Gemini 1.5 Flash / Pro using a 4-tool function-calling agent loop:
    • query_logs: Structured MongoDB log filtering.
    • semantic_search: Semantic vector search over security telemetry.
    • get_ip_reputation: Threat intelligence IP risk checking.
    • suggest_remediation: Automated incident response playbooks.
  4. Vector Database: MongoDB Atlas Vector Search storing 3072-dimensional log embeddings generated via gemini-embedding-001.

🧮 Mathematical Model & Cost Efficiency

Traditional enterprise SOC analyst costs vs. ThreatLens Gemini-powered API costs can be modeled as:

$$ \text{Cost Savings (\%)} = \left( 1 - \frac{C_{\text{Gemini API}} + C_{\text{Hosting}}}{\text{Salary}_{\text{SOC Analyst}}} \right) \times 100 $$

Where log vector embeddings are embedded in a 3072-dimensional vector space: ( \vec{v}_{\text{log}} \in \mathbb{R}^{3072} ), allowing cosine similarity search against threat knowledge bases in under ( <50\text{ms} ).

🚧 Challenges We Ran Into

  • Latency in Multi-Step Function Calling: Ensuring Gemini's agentic tool-execution loop remained fast enough for real-time threat response required optimizing prompt schemas and implementing parallel tool calls.
  • Handling High-Dimensional Vector Embeddings: Generating and querying 3072-dimensional embeddings via gemini-embedding-001 in MongoDB Atlas required tuning vector index dimensions and indexing rules.
  • BYOK (Bring Your Own Key) Security: Designing an enterprise-grade client-side key injection mechanism allowing users to pass their own Google AI Studio Gemini key (X-Gemini-API-Key) without leaking credentials on the backend.

🧠 What We Learned

  • How to build robust agentic loops using Google Gemini Function Calling.
  • Leveraging MongoDB Atlas Vector Search for semantic anomaly detection in high-volume security logs.
  • Designing cyber-themed, high-performance UI systems with dynamic glassmorphism and real-time state visualization.

🚀 What's Next for ThreatLens

  • Automated SOC Playbooks: Autonomous auto-mitigation rules for verified critical threats without manual human approval.
  • Multi-Cloud Log Ingestion: Native integrations for AWS CloudTrail, Google Cloud Logging, and Azure Sentinel.
  • Slack & Discord Bot: ThreatLens AI bot responding directly in incident response Slack channels (#incident-room).

Built With

Share this project:

Updates