Sagar B. Suryawanshi

ToolWarden AI

🛡️ Firewall between AI agents and their tools — stops hijacked instructions from becoming rogue actions

AI agents that browse the web or call APIs can be hijacked by instructions hidden inside what they read — a webpage telling the agent to send an email nobody asked for. ToolWarden sits between the agent and every tool call, scores each one with a trained ML ensemble (DeBERTa + LightGBM), and actually blocks, quarantines, or holds risky calls for human approval, not just flags them. Reported honestly: on real novel attacks the model never trained on, it still catches 91% of threats, but roughly 7 in 10 of what it flags is a false positive — published as the real number, not a friendlier blended one.

131 tests · 3 integration paths · block / quarantine / hold enforcement

Wazuh Purple Team Lab

🧪 Purple team lab testing whether Wazuh's detection rules actually catch real attacks

Installing a SIEM isn't the same as having working detection — vendor rulesets ship generic and have to be proven against real attacks first. This lab simulates real MITRE ATT&CK techniques against a monitored Windows endpoint, then checks what Wazuh's default ruleset actually catches. Cycle 1, covering 3 techniques, already found real problems: one generated zero alerts, one falsely flagged normal activity as Critical 18+ times, and one real persistence technique scored as Low severity. Each was fixed with a custom rule and re-tested. Actively expanding next: broader technique coverage, one-command provisioning.

Cycle 1 · 3 tactics tested · 3 custom rules written

CryptoVaultX

🔐 End-to-end encrypted file storage platform with client-side cryptography and role-based access control

Most file storage systems trust the server too much — plaintext data sits in databases waiting to be breached. CryptoVaultX encrypts files client-side with AES-256-GCM before they ever leave the browser, enforces role-based access control, and runs as a Dockerised microservice. Zero plaintext reaches the server at any point. Stack: Python, Flask, PostgreSQL, Docker.

NetTrace

🌐 Network reconnaissance and attack surface mapping tool built on Nmap automation

SOC analysts need to rapidly understand an environment's attack surface during an investigation — manual Nmap commands don't scale under pressure. NetTrace wraps Nmap automation in a Flask interface, enabling one-click network scanning, service enumeration, and port-to-risk mapping. Designed around a real L1 analyst investigation workflow, not a CTF.

CredentialRisk Auditor

Authentication security analysis tool for evaluating password policy weaknesses and hashing algorithm strength

Weak password policies remain a top credential attack vector. This toolkit simulates dictionary and brute-force attacks against common hashing algorithms to calculate real cracking time — making the risk concrete, not theoretical. Results are used to argue empirically for stronger hashing (bcrypt, Argon2), mandatory salting, and modern credential policy standards. Built for security awareness and policy validation, not exploitation.

KeyStroke Monitor

🧪 OS-level keystroke capture tool for adversary simulation and detection research

Part 1 of a two-part security research project. To build an effective defence, you first need to understand the attack in detail. KeyStroke Monitor is a low-level OS keystroke capture tool built specifically to study the precise behavioural patterns of a real keylogger — API call sequences, timing signatures, and process injection methods.

Anti-Keylogger

🛡️ Behavior-based detection and mitigation tool for keystroke logging threats

Part 2 of the research series. Using the behavioural patterns mapped in Part 1, Anti-Keylogger detects and terminates unauthorised keystroke capture processes in real time — implementing process monitoring and behavioural detection logic that mirrors basic EDR functionality. Attack, understand, defend.