NyxAI is a multi-agent platform that automates security operations — alert triage, threat investigation, and incident response — while keeping human analysts in control of every real action. Deployed and running on AWS today.
Most security work is repetitive and labor-intensive — triaging thousands of alerts, looking up indicators across many tools, and drafting reports before any action is taken. Response is slow, 24/7 coverage is hard to staff, and real threats slip through the noise. This is exactly the load AI can lift.
An orchestrator routes each request to one of two permission-separated agents. NyxRead analyzes — logs, threat intelligence, GuardDuty / Security Hub findings, IAM privilege-escalation audits, XDR data — with no write access. NyxRespond executes response, but only after approval.
Every destructive action — blocking an IP, adding an IOC, closing an incident — is held at a human-approval gate over Telegram (NyxGuard). Authority is enforced outside the AI prompt: nothing touches a live system without an explicit Approve.
NyxFlow continuously pulls detections from XDR, enriches indicators, and proposes an evidence-backed response for approval — then blocks across platforms on approval, or closes as a false positive. Analysts also work interactively through a web portal with SSO + MFA.
Cortex XDR, Trend Vision One, AWS WAF, Cloudflare, GuardDuty, and Security Hub — reading findings and, on approval, pushing blocks and indicators of compromise.
The core is Amazon Bedrock AgentCore + Claude models; each agent has its own least-privilege IAM role, and infrastructure runs in a dedicated isolated VPC. The largest and fastest-growing cost is Amazon Bedrock inference, scaling with alert volume, integrations, and analyst seats.
Evaluated against OWASP LLM Top 10, OWASP Agentic ASI, MITRE ATLAS, and STRIDE — with structural read/write separation, human-in-the-loop control, JWT + MFA, input guardrails, and an isolated VPC.
A model router (cheap open-weight models for routine tasks, higher-tier Claude for complex reasoning) to optimize cost; optional self-hosted open models for fully in-account inference; and broader SOAR integrations.