Most of the security tooling I used in coursework and CTFs was built for one of two buyers: enterprises with a SOC and a budget line for a full analyst team, or hobbyists running a scanner against their own lab. Almost nothing was built for the company in between — the fifty-person logistics firm, the regional healthcare group, the early-stage startup that just closed a funding round and suddenly has a compliance checklist to worry about. That gap is why Aegis exists.
The actual problem
Nmap, Shodan, and a dozen OSINT tools will happily tell you everything that is exposed about a target. What they will not do is tell you which of those findings actually matters. A small security team — or worse, a single IT generalist wearing a security hat part-time — gets a scan report with two hundred findings and no sense of priority. Triage becomes the bottleneck, not detection. I watched this happen secondhand through friends doing security work at smaller companies, and it is the same story every time: tools generate noise, humans have to manually correlate it against CVE databases and business context, and by the time triage finishes, the exposure window has already been open for days.
What Aegis actually does
Aegis is built around three stages that used to be manual and disconnected:
- Autonomous reconnaissance — OSINT enumeration and Nmap-based service discovery, run headless against a target domain on a schedule instead of only when someone remembers to kick off a scan.
- Correlation, not just collection — findings get matched against CVE data automatically, so a team sees "this specific exposed service maps to this specific known exploit" instead of a flat list of open ports.
- Structured reporting — output in both machine-readable JSON (so it can feed into whatever tooling a team already has) and human-readable markdown (so a non-specialist can actually read it without a security background).
The backend is Python and FastAPI, with PostgreSQL holding scan history so we can show drift over time instead of a single point-in-time snapshot. The LLM layer sits on top of the correlation step — its job is not to replace the scan data, it is to explain it in language a business owner can act on.
What I got wrong early on
My first version tried to have the LLM agent do the reconnaissance itself — reasoning about what to scan next, dynamically. It was slow, non-deterministic, and expensive to run. The fix was boring and correct: deterministic tooling (Nmap, structured OSINT queries) does the data collection, and the LLM is scoped strictly to analysis and reporting on data that already exists. Agents are good at reasoning over information. They are not a replacement for a reliable pipeline that gets the information in the first place.
Where it stands
Aegis is still early — I am the founder and, most days, the only engineer. But the thesis has held up every time I have tested it against a real scenario: security is not a tooling problem for the mid-market, it is a triage problem. Anyone can point a scanner at a domain. The value is in getting from "here are two hundred findings" to "here are the three that matter and here is why" without needing a dedicated analyst to do it by hand.
If you run security for a team this size and want to compare notes, email me — I am always looking for people who have felt this problem firsthand.