Air-gapped cybersecurity assistant for security professionals. 100% offline AI-powered analysis tool for Nmap, Volatility, BloodHound, Metasploit, YARA, and more. Built for environments where cloud AI isn't available.
Syd is an air-gapped penetration testing assistant that analyzes scan outputs using local LLMs and retrieval-augmented generation. It runs entirely on your laptop without requiring internet connectivity or API keys.
Syd parses technical scan outputs (Nmap, BloodHound, Volatility) and answers questions in plain English. Instead of manually reviewing hundreds of pages of results, you can ask specific questions and get evidence-based answers grounded in your actual scan data.
Supported Tools:
Key Features:
Syd uses a three-stage pipeline:
The fact extraction stage uses regex and structured parsing (no LLM). This ensures 100% accurate data extraction. The LLM only generates natural language explanations based on verified facts.
Validation checks every generated answer against extracted facts. If the LLM mentions data not present in your scan (PIDs, IP addresses, hostnames, etc.), the answer is rejected.
Hardware:
Software:
Tested Configuration:
Run one command and everything is handled automatically:
python setup.py
This script will:
Time required: 15-30 minutes (mostly downloading)
No HuggingFace account required. FAISS indexes are included in the repository.
If setup.py fails, install manually:
pip install -r requirements.txt
Download model from HuggingFace:
Run Syd:
python syd.py
See INSTALL.md for detailed troubleshooting.
Tested on real pentest data:
The validation layer prevents hallucinations. Answers that reference non-existent data are blocked.
Syd_V3/
├── syd.py # Main application
├── nmap_fact_extractor.py # Nmap parser
├── bloodhound_fact_extractor.py # BloodHound parser
├── volatility_fact_extractor.py # Volatility parser
├── bloodhound_analyzer.py # BloodHound analysis logic
├── volatility_analyzer.py # Volatility analysis logic
├── knowledge_bases/ # Technical documentation
│ ├── bloodhound/
│ └── volatility/
├── rag_engine/
│ ├── models/ # LLM models (GGUF format)
│ └── embeddings/ # FAISS indexes
└── chunk_and_embed_*.py # Knowledge base indexing scripts
LLM: Qwen 2.5 14B (Q5_K_M quantization) Embeddings: all-MiniLM-L6-v2 (sentence-transformers) Vector DB: FAISS (CPU-optimized) GUI: tkinter (cross-platform)
Temperature: 0.05-0.1 (low to reduce hallucinations) Repeat penalty: 2.8-3.2 (prevent looping) Context window: 4096-8192 tokens
Designed for typical pentest scenarios (10-500 hosts). Enterprise-scale scans may require chunking.
Model not found:
rag_engine/models/qwen2.5-14b-instruct-q5_k_m.ggufFAISS index not found:
python chunk_and_embed_*.py scriptsrag_engine/embeddings/customers/Out of memory:
Slow performance:
Community Support:
Professional Support: If you're in an air-gapped environment and struggling with setup, I offer pre-configured USB installations for a small fee. Everything included and tested.
Contact: [email protected]
Resources:
Particularly interested in:
See CONTRIBUTING.md for guidelines.
MIT License - See LICENSE file
Built using:
Developed and tested on real penetration testing data.
Author: Paul Armstrong (@Sydsec) Website: https://sydsec.co.uk YouTube: https://www.youtube.com/@paularmstrong8306