Vrikaan — AI Threat Detection Platform

objective

Build consumer-facing threat detection that holds up against live phishing and scam campaigns.

environment

• Phishing analysis
• Real-time monitoring
• Dark-web exposure scanning

approach

1. 01Analysed live phishing and social-engineering campaigns and converted the attacker techniques into automated detection and classification logic.
2. 02Designed a multi-tier routing architecture balancing heavy threat-reasoning workloads against high-volume classification.
3. 03Led security engineering and production service reliability for the platform.

outcome

• ›Live platform covering phishing detection, monitoring and dark-web exposure scanning.
• ›Recognised in "The Cyber 50 — India's Elite Founders List" (Indian Startup Times).

highlights

• $Found and fixed a quota bypass: the free-tier counter was a per-instance in-memory map, so on serverless it died at every cold start and a documented three-a-day limit was in practice unbounded — a caller only had to spread requests across instances. Counters moved into Firestore transactions
• $Quota scopes are hashed before storage, so enforcing a per-IP limit does not mean keeping a list of IPs
• $Payments verified server-side twice: a session, a webhook, then an independent confirmation, because a client claiming it paid is not evidence that it did
• $Secret boundary enforced by naming: anything VITE_ prefixed compiles into the browser and is treated as public, and the keys are not
• $Attacker techniques turned into classification logic, written back into language a non-specialist can act on
• $Scheduled backups and a runbook written for whoever is on call, not for its author

scope

Every technique referenced here was executed inside authorised environments — my own virtualised lab hosts, DVWA, and systems I was engaged to assess. Attack simulation is always paired with the detection or hardening that answers it: that pairing is the whole point of the work, not a disclaimer on it.