~/kunaldoit

projects / cyber-agents

Cyber Agents

A team of AI agents that reviews a small business's security from the outside and explains every finding in plain language.

Security review page for a demo bakery, showing scope and the review timeline.
Security review page for a demo bakery, showing scope and the review timeline.
Table of security findings, each with a reviewer note confirming or downgrading it.
Table of security findings, each with a reviewer note confirming or downgrading it.
Cards for each agent on the review team, including a reviewer that dismissed a finding.
Cards for each agent on the review team, including a reviewer that dismissed a finding.
Security review report on a phone, with a summary and a findings table.

Customer

Owners of small businesses (a bakery, a dental office, a five-person agency) who send invoices by email and keep customer data, but can't afford a security team. Also people learning security who want to see the work done, not just read about it.

Problem

Most small businesses never get a security review. The tools that exist assume an expert at the keyboard, and their reports are lists of jargon an owner can't act on. So the easy fixes, like email spoofing protection or an expiring certificate, sit untouched until something goes wrong.

Outcome & measures

Point it at a business's public footprint. Agents run passive checks, an independent reviewer challenges every finding, and the owner gets a plain-language report and a fix plan they can work through without a security background.

  • Run a complete review of a real small business's public footprint and hand over a report I'm proud of
  • Zero out-of-scope network activity (passive checks only, scope checked before every call)
  • Every tool call written to an append-only audit log
  • A fix plan an owner can work through without a security background

What's next · Nov 2026

The first real review end to end, using the lab-run checklist, then fixing whatever the report gets wrong.

Why I built it

I wanted to learn security by doing it, and small businesses are the ones nobody serves. So I built one tool for both: running a review and watching agents explain their work are the same activity.

How it came together

An Analyst agent proposes findings, a separate Reviewer argues with them, and a Tutor and Writer explain and report. Phase 1 was a one-shot review. Phase 2 added a fix plan and a watch for newly exploited vulnerabilities. Both were built in two days.

What I learned

The rules mattered more than the agents. Agents assist, I authorize; nothing touches a system outside the signed scope; every agent runs fenced off with no tools. Deciding what the agents may never do made the rest easy to build.