cogensec/gideonAutonomous security operations agent for threat intelligence, vulnerability research, IOC analysis, and red teaming. Supports dual-mode operations with modular skills for CVE research, post-exploitation, payload generation, and AI-powered defensive analysis.
██████╗ ██╗██████╗ ███████╗ ██████╗ ███╗ ██╗ ██╔════╝ ██║██╔══██╗██╔════╝██╔═══██╗████╗ ██║ ██║ ███╗██║██║ ██║█████╗ ██║ ██║██╔██╗ ██║ ██║ ██║██║██║ ██║██╔══╝ ██║ ██║██║╚██╗██║ ╚██████╔╝██║██████╔╝███████╗╚██████╔╝██║ ╚████║ ╚═════╝ ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═══╝
Built by Requie Co-Founder at Cogensec — Security infrastructure for intelligent machines
🏆 NVIDIA GTC 2026 Golden Ticket Winner — Recognized in the NVIDIA Developer Contest for breakthrough work in autonomous AI security operations.
Intelligence Gathering ➜ Threat Analysis ➜ CVE Research ➜ IOC Reputation ➜ Policy Generation ➜ Daily Briefing
Gideon is not a script. It is not a scanner. It is an autonomous security operations agent that thinks, plans, and acts — transforming complex threat intelligence questions into step-by-step research missions, executing them against live data sources, checking its own reasoning, and delivering confident, evidence-backed answers.
Where traditional security tools require expert configuration and manual correlation, Gideon operates with goal-directed autonomy: break down the problem, retrieve the data, validate the results, and synthesize a clear picture of the threat landscape.
Built for dual-mode operations — functioning as a defensive analyst by default (detection, mitigation, and protection) but capable of transitioning into a fully autonomous Red Team Mode for authorized offensive security engagements. Every response is grounded in real data, every action is auditable, and every output is actionable.
> gideon cve CVE-2024-21887
🔍 Researching CVE-2024-21887...
📡 Querying NVD API...
📋 Cross-referencing CISA KEV catalog...
🧠 Analyzing exploit chain and affected systems...
🛡️ Generating mitigation strategy...
✅ CVE-2024-21887 | Ivanti Connect Secure | CVSS 9.1 (Critical)
Command injection in web components — exploited in the wild.
CISA KEV: Yes | Patch Available: Yes
Recommended: Immediate patching + IoC sweep on outbound traffic.
| Capability | Description | Data Source |
|---|---|---|
| 🔎 CVE Research | Deep vulnerability analysis with CVSS scoring, patch status, and exploit context | NVD + CISA KEV |
| 🌐 IOC Analysis | Reputation checking for IPs, domains, URLs, and file hashes | VirusTotal + AbuseIPDB |
| 🧠 Neural Search | Semantic deep-web research for obscure advisories and technical write-ups | Exa AI |
| 🤖 Multi-Model | Unified access to 400+ LLMs from OpenAI, Anthropic, Google, and 50+ providers | OpenRouter |
| 📰 Daily Briefings | Automated threat intelligence digests with notable incident tracking | Live feeds |
| 🛡️ Policy Generation | Security hardening checklists for AWS, Azure, GCP, Kubernetes, and Okta | Framework-aligned |
| 🔴 Red Teaming | Sandboxed autonomous exploitation, C2 session wrapping, and lateral movement | Internal / C2 |
| 🔌 MCP Protocol | Extensible tool integration via Model Context Protocol servers | Custom + community |
| ✅ Self-Verification | Cross-source validation with defensive-only and engagement-scoped safety blocks | Internal |
Gideon is purpose-built to leverage NVIDIA’s enterprise AI infrastructure — recognized at NVIDIA GTC 2026 as a leading implementation of the NVIDIA AI stack for security operations.
┌─────────────────────────────────────────────────────────┐
│ NVIDIA AI STACK │
├──────────────┬──────────────┬──────────────┬────────────┤
│ NIM │ Morpheus │ PersonaPlex │ NeMo │
│ GPU-accel │ Threat │ Voice AI │ Guardrails │
│ local LLMs │ Detection │ Ops Mode │ & Safety │
└──────────────┴──────────────┴──────────────┴────────────┘
│
┌───────▼───────┐
│ RAPIDS │
│ Accelerated │
│ IOC Analysis │
└───────────────┘
| Component | Role in Gideon |
|---|---|
| NIM | GPU-accelerated local LLM inference — run models on-prem with sub-second latency |
| Morpheus | Real-time threat detection pipelines: DFP anomaly detection, DGA analysis, anti-phishing |
| PersonaPlex | Hands-free voice AI for eyes-off security operations |
| RAPIDS | Accelerated data science for batch IOC analysis and large-scale threat correlation |
| NeMo Guardrails | Enterprise-grade AI safety, topic steering, jailbreak detection, and audit logging |
Gideon’s modular Skills architecture extends core capabilities with specialized intelligence modules. Each skill operates as an autonomous sub-agent with its own toolset, state machine, and command vocabulary.
Advanced-mode bug bounty hunting, penetration testing assistance, and CTF operations.
> skills security start bounty # Launch bug bounty research mode
> skills security scope [program] # Define the target scope
> skills security recon [target] # Begin passive reconnaissance
> skills security hunt [vuln-class] # Focus hunt on vulnerability class
Modes: bounty · pentest · research · ctf
Autonomous post-exploitation operations for authorized engagements: AD mapping, lateral movement, and privilege escalation.