• 

TraceLock — AI-Powered Incident Response with Verifiable Security Decisions

Inspiration

Security teams face a growing challenge: detecting a threat is only the beginning. Investigators must connect evidence across multiple sources, understand what happened, identify the likely cause, and determine whether containment actually succeeded.

AI can accelerate this process, but trusting an AI-generated conclusion without verification creates another security risk. An assistant might recommend an action or report success without sufficient evidence that the incident is resolved.

We built TraceLock to address this gap: an AI-powered incident response platform that combines the reasoning capabilities of NVIDIA Nemotron with deterministic security checks, evidence-linked findings, bounded tool execution, and external threat-intelligence enrichment.

Our guiding principle is simple: AI should help investigate the incident, but verified evidence should determine the outcome.

What it does

TraceLock provides an AI-assisted workflow for investigating simulated cybersecurity incidents.

• AI-powered investigation: Uses NVIDIA Nemotron through Nebius Token Factory to analyze incident context and help produce structured investigative findings.
• Bounded tool orchestration: Allows the investigation workflow to execute a controlled set of tools rather than giving the model unrestricted access to systems.
• Evidence-linked findings: Connects investigative conclusions to supporting evidence so analysts can understand the basis for each finding.
• Tavily threat-intelligence enrichment: Integrates Tavily Search to retrieve relevant external intelligence for eligible IPv4 indicators found in synthetic incident timelines. Retrieved source titles, URLs, and excerpts remain distinguishable from original incident evidence.
• Deterministic containment verification: Independently evaluates containment status using application logic instead of simply accepting the model's claim that an incident has been resolved.
• Synthetic incident scenarios: Demonstrates the investigation and verification workflow without taking real-world cloud security actions.

TraceLock is designed to make incident investigation more transparent, structured, and verifiable.

How we built it

We built TraceLock as a full-stack application with a separate frontend and API server.

AI and inference: We integrated NVIDIA Nemotron through Nebius Token Factory to support the incident investigation workflow.

Investigation orchestration: The API server coordinates model output and a bounded set of investigation tools. Structured responses are validated before they are used by the application.

Threat-intelligence enrichment: We integrated Tavily Search as a bounded enrichment capability for eligible IPv4 indicators found in synthetic incident timelines. The integration limits the number of returned results, applies a timeout, and preserves source titles, URLs, excerpts, and metadata. Retrieved content is treated as untrusted external input, not as authoritative incident evidence.

Evidence and findings: Investigation results are organized into findings with supporting evidence, helping users trace conclusions back to the information available to the system. External intelligence supplements the investigation without replacing the original evidence.

Independent verification: A deterministic incident engine evaluates containment separately from the AI-generated investigation. This separation helps prevent a model's unsupported assertion from being treated as proof of successful containment.

Frontend and deployment: We built the user interface and API as separate services and deployed them using Render, with a static frontend and a Node.js API service.

The architecture keeps AI-assisted reasoning, external intelligence, and deterministic checks separate, making investigation results easier to inspect and validate.

Challenges we ran into

One of our central challenges was making the AI integration reliable enough for a structured security workflow. Model responses can vary, omit expected fields, or return optional values in unexpected forms. We had to validate model output carefully instead of assuming every response would match the expected schema.

Another challenge was designing the boundary between AI reasoning and deterministic application logic. We wanted the model to help investigate and interpret evidence without allowing its conclusions to become the sole authority on containment status.

Integrating external threat intelligence introduced another challenge: retrieved information can be incomplete, irrelevant, or untrusted. We addressed this by bounding retrieval, applying a timeout, preserving source metadata, and keeping external intelligence separate from original incident evidence and deterministic security decisions.

We also worked through deployment challenges, including configuring the API and frontend as separate Render services, connecting the frontend to the public API endpoint, and diagnosing a temporarily missing JavaScript asset during initial deployment.

These challenges reinforced an important lesson: a successful AI prototype needs more than a working inference call. It needs validation, predictable interfaces, clear trust boundaries, independent checks, and a deployment that can be tested end to end.

Accomplishments that we're proud of

• Integrated NVIDIA Nemotron inference through Nebius Token Factory into an incident investigation workflow.
• Implemented bounded tool orchestration and structured handling of model responses.
• Built an evidence-linked findings workflow that makes investigation results easier to inspect.
• Implemented a Tavily-powered threat-intelligence enrichment path with bounded retrieval and source metadata preservation.
• Separated AI-generated conclusions and untrusted external intelligence from deterministic containment verification.
• Added API tests, typechecking, and production build validation.
• Deployed the frontend and API as separate services on Render and verified that the API health endpoint responds successfully.

Most importantly, we built the project around a principle we believe matters for security AI: an investigation is not complete just because a model says it is.

What we learned

We learned that the most useful role for AI in security operations is not necessarily to replace established controls, but to help analysts navigate complex evidence and investigative workflows.

We also learned that reliability comes from the surrounding system as much as the model itself. Schema validation, bounded tool access, clear evidence references, source provenance, deterministic checks, and repeatable tests are essential when AI outputs influence security decisions.

External intelligence can strengthen an investigation, but it should not automatically become trusted evidence. Preserving its provenance and maintaining independent verification help keep the workflow more transparent and resilient.

Finally, we learned to treat deployment as part of the engineering process. A successful local build is only one milestone; the deployed application must also load, connect to its API, and complete its intended workflow.

What's next for TraceLock — AI Incident Response

Our next goal is to validate TraceLock's complete investigation workflow through realistic synthetic scenarios, including both successful and unsuccessful containment outcomes.

We plan to:

• Expand the library of incident scenarios and investigative tools.
• Improve evidence provenance and make the relationship between observations and findings more explicit.
• Improve the presentation of threat-intelligence sources, including their relevance to individual indicators.
• Evaluate investigation accuracy, evidence traceability, containment-verification correctness, and resilience to untrusted external intelligence across repeatable synthetic scenarios.
• Evaluate the consistency of model-generated findings across repeated runs.
• Strengthen error handling, observability, and deployment reliability.
• Explore integrations with security telemetry and response systems, while retaining explicit safeguards and verification before any real-world action.

Our long-term vision is to make TraceLock a trustworthy investigation assistant that helps security teams move from alert to evidence-backed understanding—with containment outcomes determined by verification, not assumption.

Built With

• ai
• api
• automation
• cybersecurity
• express.js
• factory
• incident
• nebius
• nemotron
• node.js
• nvidia
• python
• react
• render
• response
• rest
• security
• tavily
• token
• typescript