ThreatLens

24/7 Gemini-powered AI Security Copilot protecting early-stage startups with real-time log triage & 1-click threat containment.

Comment

Inspiration

Early-stage startups and solo founders drive innovation and create jobs but more than 60% of small startups experience security breaches that cost about $200,000 on average. That kind of loss can be devastating for companies that are just starting out those at pre-seed or seed stage. These early founders don’t have the budget to hire a SOC (Security Operations Center) analyst, which usually costs $150,000 or more per year nor can they afford complex enterprise tools like Splunk.. One serious incident—like a ransomware attack, a credential-stuffing breach or a leaked API key—can wipe out a startup before it even hires its first employee.

That’s why we built ThreatLens. An AI-powered security copilot that acts like a senior security architect available, around the clock. ThreatLens keeps track of system telemetry reads through security logs and helps non-security founders quickly stop threats with just one click. It brings expert-level security protection to teams that never thought they could afford it.

What it does

ThreatLens translates high-volume security telemetry into actionable plain-English executive insights:

  • Conversational Security Copilot: ThreatLens lets you ask security questions in everyday language. For example "Are there any off‑hour logins?" or "How do I contain ransomware on host‑01?".

  • 1-Click Active Threat Mitigation: ThreatLens lets you block bad IPs revoke risky API tokens and isolate infected computers with just one click from the threat dashboard.

  • ️ MITRE ATT&CK Framework Mapping: ThreatLens automatically sorts threats into standard tactics and techniques such as T1486 Data Encrypted for Impact or T1110 Password Guessing.

  • SOC2 & ISO 27001 Evidence Export: ThreatLens creates clean tamper‑evident CSV and PDF audit records for every automated tool run so you can show compliance easily.

  • Tier Advantage Matrix: ThreatLens gives a generous free tier, for solo founders and offers scalable budget‑friendly plans ($49/mo to $199/mo) for growing startup teams.

    How we built it

    ThreatLens is designed from the ground up as an AI-Native Agentic Application: | Layer | Technology | Key Details | |---|---|---| | Frontend | React 18, TypeScript, Vite | Deep Obsidian Cyber Glassmorphic SOC UI featuring interactive 360° laser threat radars, particle background canvas, and real-time state visualization. | | Backend & Cloud | Node.js / Express | Serverless containerized microservice architecture deployed on Google Cloud Run, with static assets served via Firebase & Vercel CDN. | | AI Agent Loop | Google Gemini API (@google/genai) | Powered by Gemini 2.5 Flash and Gemini 1.5 Pro utilizing an autonomous 4-tool function-calling agent loop. | | Vector Database | MongoDB Atlas Vector Search | Stores 3072-dimensional log embeddings generated via gemini-embedding-001 for sub-50ms semantic similarity queries. | | Autonomous Payments | Circle Developer-Controlled Wallets | Integrated Web3 SDK for USDC autonomous agent wallet creation, micropayments, and subscription checkouts.

    Challenges we ran into

  • Optimizing Agentic Tool-Execution Loops

I worked on making sure that Geminis step‑by‑step function calls run enough under one second so that we can react to threats in real time. This required me to engineer the prompts and run multiple tools at the same time.

  1. High-Dimensional Vector Embeddings

I generated embeddings, with gemini‑embedding‑001 and stored them in MongoDB Atlas. To keep them useful I had to adjust the size of the vector index and the way we measure similarity.

  1. BYOK (Bring Your Own Security

I created a secure client‑side key injection system. It lets developers use their Google AI Studio key, X‑Gemini‑API‑Key while keeping the key hidden from the server.

Accomplishments that we're proud of

  • Sub-Second Autonomous Gemini Agent Loop: Sub-Second Autonomous Gemini Agent Loop uses Gemini 2.5 Flash and @google/genai with four security tools: query_logs, semantic_search get_ip_reputation, suggest_remediation. Sub-Second Autonomous Gemini Agent Loop triages. Builds containment plans in seconds.

  • Dimensional Hybrid Vector Search: High-Dimensional Hybrid Vector Search indexed 3072‑dimensional vectors with gemini-embedding-001 and MongoDB Atlas Vector Search. Dimensional Hybrid Vector Search returns cosine similarity results in under 50 ms on historic log data.

  • 1‑Click Active Mitigation & SOC2 Audit Trails: 1‑Click Active Mitigation & SOC2 Audit Trails let founders block IPs and isolate infected hosts with a single click. 1‑Click Active Mitigation & SOC2 Audit Trails also writes tamper‑evident CSV and executive PDF audit logs, for SOC2 Type II and ISO 27001.

  • Deep Obsidian Cyber SOC UI: Obsidian Cyber SOC UI is a glassmorphic command centre that shows a 360° animated laser threat radar, real‑time heatmaps, particle backgrounds and synthetic attack simulations.

  • Dual Payment & BYOK Architecture: Dual Payment & BYOK Architecture links Circle Developer‑Controlled Wallets for USDC agent micro‑payments with client‑side Bring Your Own Key injection from Google AI Studio.

  • Solo Execution & XPRIZE Compliance: Solo Execution & XPRIZE Compliance built, deployed and documented the full‑stack platform alone following XPRIZE hackathon rules exactly.

    What we learned

  • Mastering Gemini Function-Calling Patterns: I learned how to build clear multi‑step reasoning loops for an agent to route tool parameters on the fly and to stop data from appearing when I convert raw syslog JSON into organized incident playbooks.

  • High‑Dimensional Vector Optimization: I obtained hands‑on expertise in setting up a MongoDB Atlas Vector Search index with 3072 dimensions matching the `gemini-model so that the system can retrieve anomalous behaviors accurately.

  • Bridging AI Decisions with Real‑World Actions: I discovered how to build human‑in‑the‑loop interfaces that allow founders who are not security experts to trust and run AI‑generated remediation commands confidently.

  • Serverless Full‑Stack Microservices: I launched fast Node.js/Express container services, on Google Cloud Run. Combined them with global CDN hosting on Firebase and Vercel ensuring the system scales smoothly.

What's next for ThreatLens

  • Turnkey Multi-Cloud Connectors: Building 1-click log ingestion pipelines for AWS CloudTrail, Google Cloud Logging, and Azure Sentinel.
  • Native Slack & Discord Incident Bot: Deploying a bidirectional ThreatLens bot into #incident-room channels so founders can review alerts and approve IP isolations directly from chat.
  • Autonomous Zero-Touch Containment: Introducing an automated rule engine that instantly isolates confirmed high-confidence ransomware attacks during off-hours without waiting for manual approval.
  • Federated Threat Intelligence on Circle Web3: Expanding Circle USDC micropayments to let startups anonymously share and monetize zero-day threat intelligence feeds with peer startups.
  • Enterprise Team Collaboration: Adding multi-tenant role-based access control (RBAC) for security teams with automated Jira and ServiceNow ticketing integrations.

Built With

Share this project:

Updates

Submission history