Multi-Agent Cyber Defense
LiveCyberShield AI — El Guardián
A live, community-trained cyber-defense platform. El Guardián classifies every incoming signal, routes it to the right specialist agent, resolves conflicts between them, and returns a single Unified Threat Report mapped to MITRE ATT&CK.
- Role
- Founder · Full-stack architect & engineer
- Timeframe
- 2025–2026 · Ongoing
- Stack & Standards
- Python · FastAPI · Multi-agent orchestration · Next.js 16
The Challenge
Where things stood
High-volume global events like the 2026 FIFA World Cup open an enormous attack surface: rapid-fire ticket fraud, phishing domains, romance scams, deepfake broadcasts, and crowd-scale traffic surges — most of it too brief and too localized for static detection tools to catch in time. I set out to build a defense brain that a non-technical public could feed, and a SOC analyst could trust.
Static threat detection misses short, context-specific fraud campaigns before financial and data loss occurs.
A single monolithic model is expensive at feed scale and hard to reason about when signals conflict.
Crowdsourced reports contain sensitive personal and financial data that must never be persisted raw.
Analysts drown in unformatted log walls — alert fatigue slows mean-time-to-respond.
The Approach
From analysis to a delivered solution
Decoupled the SOC into specialist agents
Four autonomous agents (fraud, privacy/compliance, deepfakes, crowd-scale anomalies) each own a detection gate, so logic stays isolated, explainable, and independently tunable.
Built a two-stage detection pipeline
A cheap keyword/heuristic first pass filters the firehose; the LLM is only invoked on demand, keeping model cost near zero at feed scale.
Added a conflict-resolution orchestrator
El Guardián arbitrates between agents when their verdicts disagree and composes a single Unified Threat Report mapped to MITRE ATT&CK.
Closed the loop with the community
Multilingual public submissions are PII-scrubbed on ingest, then feed public advisory streams — the users become the training set.
The Outcome
What it delivered
Specialist agents orchestrated
LLM cost at feed scale
ATT&CK-mapped reports
Deployed on Vercel + Render
Multi-agent arbitration engine with human-in-the-loop review.
PII-scrubbing on ingest and least-privilege (RBAC) access boundaries.
Responsive command-center dashboard with severity badges and one-click mitigations.
CORS-hardened API validated under simulated traffic surges.
Stack & Standards
Have a problem that looks like this?
I take security, network, and data problems from analysis to a delivered, defensible solution. Let's talk about yours.