Cybersecurity + AI for small organizations
Alerts don't stop breaches. Acting on them does.
SentrAI watches the web, database and OS layers, turns every anomaly into a live 0 to 100 risk score that grows while nobody acts, applies a temporary fix when your tolerance is crossed, and keeps tamper-evident proof of who knew what and when.
"A sentry doesn't chase you. It just guards the gate."
- SQL injection attempts on /login+25
- No acknowledgement after 2 h SLA+10
- Brute force from 3 IPs+47
- Held at the gate, block expires in 2 hhold
The problem
Small organizations get the alert. Nobody acts in time.
Singapore SMEs and private schools hold large amounts of personal data with one or two IT staff and no security team. The breach is rarely a surprise: the warning was there, it was just never acted on.
Maximum PDPA penalty since Oct 2022: S$1 million or 10% of annual Singapore turnover (above S$10M), whichever is higher.
PDPC, Guide on Active EnforcementStudents' data sold online after a pentest-reported SQL injection hole at a tuition company went unfixed for two months.
PDPC decision, ChampionTutor (2021)Of the ~4,484 alerts a security team receives each day go ignored, according to a survey of 2,000 SOC analysts.
Vectra AI, State of Threat Detection 2023How it works
From log line to accountable decision, in four steps.
A collector reads what your systems already log, AI classifies it, the risk engine scores it, and the responder acts only inside your own network, always reversibly.
Collect
Web, database and OS logs are gathered per layer. Scout helps a novice technician find where logs live on unfamiliar systems.
Classify
Rules plus AI categorize each event (brute force, SQL injection, exfiltration, misconfiguration) with a confidence that feeds the score.
Score
A live 0 to 100 risk index with an inaction penalty, so an ignored alert gets louder every hour instead of fading away.
Respond
Past your threshold, SentrAI blocks or locks with a time limit, escalates up the ladder, and writes every step to a hash-chained log.
What makes it different
Built for teams of one or two, not a 24/7 SOC.
Every automatic action is temporary, every decision is recorded, and a human always has the final say.
Risk grows with inaction
Unaddressed alerts add points every hour past the SLA, so neglect is visible on the gauge long before it becomes a breach.
Every fix expires
Automatic blocks carry a time limit (default 2 hours). A person must make them permanent, extend them, or roll them back.
Tamper-evident evidence
A hash-chained audit log and evidence report show what was detected, who was told, and what was done, for PDPA Protection Obligation reviews.
Cyanide, the AI planner
An AI incident planner picks containment steps for your system profile, while scoring, time limits and the audit trail stay deterministic.
Ask before you approve
Operators chat with Cyanide to understand an incident. Suggestions arrive as buttons that go through the normal approval gates.
Escalation that reaches people
Dashboard and Telegram alerts climb from the on-duty operator to the team lead, IT manager and CXO as the risk band rises.
The sentry principle
It guards the gate. It never walks through it.
SentrAI never hacks back. Striking an attacker's machine is an offence under Singapore's Computer Misuse Act, and attacks usually come through hijacked computers owned by other victims. Everything it does happens on your side of the line.
What SentrAI does, inside the gate
- Blocks IPs, locks accounts and rate-limits logins
- Slows attackers down with tarpits
- Plants honeytokens that raise a near-certain alert when touched
- Preserves evidence for SingCERT or the police
What SentrAI never does
- Access, scan or disrupt the attacker's systems
- Make a fix permanent without a human decision
- Change anything outside a pre-approved playbook
- Claim an alert was read when it was only delivered
"It holds the line and never crosses it."
Why SentrAI
Three tools you'd otherwise buy separately, in one product.
Automated response, on-call escalation and compliance evidence all exist today, but as separate products sized for larger teams.
| Need | Usually | SentrAI |
|---|---|---|
| Contain an attack | Enterprise auto-response tools, fixes can stay forever | Temporary fixes that expire without a human decision |
| Make sure someone acts | A separate on-call paging service | Risk that grows with inaction, plus an escalation ladder |
| Prove due diligence | A separate compliance platform | Hash-chained evidence built from the same incident |
Working prototype
Point it at your logs. SentrAI handles the attacks.
The MVP runs on one laptop or a Linux server: SentrAI reads the logs you approve, scores the risk, alerts the operator, blocks the attackers when the score crosses 80, and writes a hash-chained evidence report. One script starts everything, and automated tests cover every part.
Architecture: collector, classifier and responder around a deterministic risk engine.
Roadmap
From hackathon MVP to a pilot in about five months.
Nine phases, roughly 105 developer-days. The critical path runs through hardening, real collectors, real containment and the pilot.
- P0Finish the hackathonSep 2026
- P1Harden the coreOct
- P2Real data collectionOct to Nov
- P3Trustworthy AIOct to Nov
- P4Real containmentNov
- P5EscalationNov
- P6Evidence reportsNov to Dec
- P7Agent servicesDec
- P8PilotJan to Feb 2027
Team
The people behind SentrAI.
Read the full plan
Problem, data collection per layer, the risk formula, the hotpatch workflow, ethics and the MVP demo script.