Cloud honeypot with a live threat map.

Runs fake SSH, Telnet, and web login services on an Azure VM. Bots find it within minutes and start guessing passwords. Every attempt is geo-tagged, shipped to Azure Log Analytics via managed identity, and drawn on a live world map as it happens. Four Sentinel analytics rules detect brute force, password spray, multi-protocol recon, and web exploit probes - each mapped to MITRE ATT&CK. One terraform apply builds the entire stack.

Nothing ever logs in. There is no shell behind any of the fake services.

Threshold

Active Directory brute force defense lab. Four Vagrant VMs: a Windows Server 2022 DC, a domain-joined workstation, a Wazuh SIEM, and a Kali attacker. Custom Wazuh rules detect brute force, password spray, and account lockout with MITRE ATT&CK mapping. Active response auto-blocks repeat offenders.

Wazuh Active Directory Vagrant PowerShell

Palisade

Multi-cloud security posture management for AWS and Azure. Scans for misconfigurations, auto-remediates them, and validates fixes with attack simulation. Continuous compliance checks against CIS benchmarks.

Python AWS Azure Terraform

Aegis

Tamper-evident audit log and streaming threat detection engine. Append-only event log with cryptographic chaining, Merkle tree batching, and Ed25519-signed checkpoints. Any modification to historical events is detected and pinpointed. A streaming rules engine evaluates every event on arrival. Zero external dependencies.

Go Ed25519 Merkle trees

Forge

ICS/SCADA security monitoring lab. Simulated water treatment plant on a hand-built Modbus TCP server with an HMI control loop, passive traffic monitor, OT asset discovery, and seven detection rules mapped to MITRE ATT&CK for ICS. Includes recon, hijack, and DoS attack scripts.

Python Modbus TCP ICS/SCADA MITRE ATT&CK

Threshold / Attack Scripts

Password spray and brute force tooling built for the AD defense lab. SMB spray with netexec stays under per-account lockout to trigger spray detection rules. Single-target brute force deliberately crosses the lockout threshold to test active response and GPO defenses.

Bash netexec SMB Kerberos

Forge / Attack Scripts

ICS/SCADA attack toolkit. Modbus reconnaissance scanner that enumerates unit IDs and function codes. Hijack scripts that drain tanks, overdose chemicals, trigger e-stops, and mask alarms. Modbus flooding for PLC denial of service.

Python Modbus TCP ICS/SCADA

VaultKey

Automated secrets rotation engine on AWS. Rotates database credentials, API keys, and arbitrary secrets on a configurable schedule via Lambda and Secrets Manager. Drop-in compliance primitive for SOC 2 and ISO 27001 environments.

Python AWS Lambda Secrets Manager

GRC Vendor Risk Engine

Vendor risk scoring platform. Ingests vendor questionnaires, scores risk across security, privacy, and operational dimensions, and flags vendors that fall below policy thresholds.

Python Go PostgreSQL

PlanGuard

Terraform security scanner. Checks a terraform plan for security misconfigurations before you run terraform apply. Catches public S3 buckets, open security groups, unencrypted storage, and missing logging before they reach production.

Python Terraform CI/CD

Watchpost

AWS account monitoring with auto-remediation. Watches CloudTrail for risky changes - public S3 buckets, open security groups, disabled logging - and fires Lambda functions to revert them automatically. EventBridge rules, SNS alerts, fully Terraformed.

Python AWS Lambda CloudTrail Terraform

Netwatch

Distributed network anomaly detection. C++ packet capture, Java coordination layer, R statistical analysis. Detects port scans, beaconing, and traffic volume anomalies.

C++ Java R

NexusGuard

Distributed rate limiter with four algorithms (fixed window, sliding window, token bucket, leaky bucket) and Prometheus metrics. Protects APIs from abuse and DDoS at the edge.

Python Redis Prometheus

Carcajou

GNSS-denied vehicle navigation with a 15-state error-state Kalman filter. Stereo VO and LiDAR map matching. Drift under 0.01% over 120 s outages. Includes a synthetic test harness with CI-asserted accuracy.

Python Kalman filter LiDAR

Beacon

Robot fleet telemetry platform. MQTT to AWS IoT Core, Kinesis hot path for live monitoring, Firehose cold path for S3 Parquet analytics. Fully Terraformed.

ROS2 AWS IoT Kinesis Terraform