Security Platform — 2026
CYFER ONE
“You cannot segment a network you cannot see.”
Role
Sole designer and engineer — concept through production deployment
Context
Industrial training, U Mobile — Information Services / Information Security
Focus
Disclosure
Built inside a telco security division. This case study covers architecture and engineering decisions only — no real hostnames, addresses, topology or asset data appears anywhere on this page. Interface visuals are reconstructions using fabricated demonstration data.
Months, concept to production
Subsystems delivered
Engineer
An internal platform that discovers what is actually running on the network, consolidates months of scan results into one authoritative asset view, and gives the security team the evidence they need to make segmentation decisions. Built end to end during a five-month industrial placement and presented to the CIO.
The problem
Server inventory lived in spreadsheets that went stale the moment they were saved. Scans produced raw output nobody had time to reconcile, so the question "what is on this segment, and should it be?" took days to answer and the answer was never quite trusted. Without a dependable inventory, segmentation work stalls — you cannot draw a boundary around assets you have not confidently enumerated. Compliance reporting had the same root problem, and was assembled by hand each cycle.
What I built
CYFER ONE automates the whole loop. A Python worker runs Nmap over SSH against defined scopes and streams results back as JSON events; a Node.js orchestration layer supervises those runs with heartbeats and process-liveness checks so a hung scan surfaces as a failure instead of silence. Results land in a temporal PostgreSQL model that keeps every monthly snapshot while projecting a single current-state asset view, so you can ask both "what is there now" and "what changed since last month". On top sits role-based access scoped by division, scheduled Excel compliance reports published straight to SharePoint, and an AI assistant that answers natural-language questions by querying the live database through tool-calling.
How it works
Scanning engine
A Python worker drives Nmap over SSH via Paramiko against explicitly defined scopes. Rather than waiting for a scan to finish and parsing a file, the worker emits newline-delimited JSON events as hosts resolve, so the UI shows progress in real time and a long sweep never looks frozen.
Liveness and failure surfacing
Long-running scans fail in quiet ways — a dropped SSH session looks identical to a slow subnet. The Node.js supervisor tracks heartbeats and process liveness, so a stalled worker is reported as a failed run with a reason instead of hanging indefinitely.
Temporal data model
Scan results are stored as immutable monthly snapshots in PostgreSQL through Prisma, with a derived current-state view layered on top. Overwriting would have been simpler, but it destroys the audit trail — and "when did this host appear" is exactly the question segmentation work depends on.
Authentication and division-scoped RBAC
NextAuth with bcrypt password hashing, JWT sessions and TOTP-based MFA. Authorisation is scoped by division, so a user sees only the assets their team owns — necessary for a tool that inventories infrastructure across an organisation.
Automated compliance reporting
A cron-scheduled job generates Excel compliance workbooks and publishes them to SharePoint through the Microsoft Graph API, replacing a manual assembly step that recurred every reporting cycle.
AI assistant with tool-calling
An assistant layer exposes read-only database queries as tools to an LLM (Gemini and Anthropic), letting the team ask questions in natural language and get answers computed against live data rather than against the model’s guess.
3D topology view
An interactive Three.js visualisation of network topology, built so segment relationships could be read at a glance in a review meeting instead of traced through a table.
Outcome
Asset consolidation moved from a manual spreadsheet exercise to a scheduled pipeline, and segmentation discussions started from evidence rather than recollection. Compliance reports that were assembled by hand now generate and publish on a cron schedule. The system was delivered to production and presented to the CIO at the close of the placement.
Stack
← No previous