paul2495

Hey HN,

  As a security analyst, a typical workflow for me was a frustrating juggling act: run an Nmap scan, manually parse the output, search for CVEs, find an exploit script, set up a listener in Metasploit, and then finally launch the exploit.

I was drowning in terminal windows and context-switching, and I knew there had to be a better way.

  So, I built Syd: a desktop assistant that acts as an intelligent front-end for the security tools I use every day. My goal was to create an "analyst co-pilot" that automates the tedious parts and provides expert guidance, letting me

focus on the actual analysis. It's built in Python with a simple Tkinter GUI.

Here's a concrete example—the "Pwn a Box" workflow that Syd now streamlines:

   1. Recon: I kick off an Nmap scan directly from Syd's UI.
   2. Automated Analysis: The moment the scan finishes, Syd's own rule-based engine and local CVE database parse thenresults. It automatically identifies a service (e.g., "vsftpd 2.3.4") and finds it's vulnerable, recommending a specific Metasploit module(exploit/unix/ftp/vsftpd_234_backdoor).
   3. Strategic Guidance: This is where the AI comes in. I can take that analysis and ask Syd, "What's the best way to approach this?" and its RAG-powered chat gives me high-level strategic advice on exploitation, post-exploitation, and privilege escalation, all based on its embedded knowledge base.
   4. Execution & C2: I then pivot to the Metasploit page within Syd. It uses a controller to connect to the Metasploit RPC server, pre-configures the recommended exploit, sets the LHOST/RHOST, and launches it. When the exploit succeeds, the new session appears right there in the UI, ready for interaction.

  What used to be 30 minutes of manual work across five different tools is now a guided, 2-minute workflow within a
  single interface.

  For security, the whole system is designed to be air-gapped (it's delivered on a physical SSD) and the AI assistance is powered by local models and a curated knowledge base, so no sensitive data ever leaves the machine. It also integrates Volatility for memory analysis, YARA for malware hunting, and more.

  The videos on my site are a bit rough, but they show some of this in action. The project is still evolving, and I'd love to get the HN community's feedback, ideas, or even contributions.

  There's a mailing list on the website if you're interested in major updates or want to be part of a future beta for a more advanced version.

  Website (with videos & mailing list): https://sydsec.co.uk/

Thanksthat makes sense and it never even crossed my mind . FAISS has been great for prototyping but I'm definitely hitting the limits around metadata, updates, and operational overhead.

One thing I’m exploring now is Qdrant in embedded mode, since the tool has to run in fully air-gapped environments (no internet, no external services, distributed on a portable SSD). The embedded version runs as a simple file-based directory, similar to SQLite:

from qdrant_client import QdrantClient client = QdrantClient(path="./qdrant_data") # local-only, no server If that model works reliably, it would solve several problems FAISS creates for my use case:

incremental updates instead of full index rebuilds

storing metadata as payloads instead of a 1.5GB pickle

much easier filtering (e.g., per-source, per-customer, per-tool)

better concurrency under load

I’m still benchmarking, but curious about your experience: Have you used Qdrant’s embedded mode in a production/offline scenario? And if so, how does it behave with larger collections (500k–1M vectors) on consumer hardware?

Not dismissing FAISS — just trying to pick the right long-term architecture for an offline tool that gets updated via USB and needs to stay lightweight for the end user.

Really appreciate the detailed feedback—this is exactly what I need to hear.

GPU/CPU question: Yes, Syd supports both. It auto-detects CUDA if available and falls back to CPU if not. With GPU (tested on RTX 3060), inference runs at 30-50 tokens/sec. On CPU it drops to 5-10 tokens/sec, which is usable but noticeably slower for larger responses. The model is quantized (Q4_K_M) to keep VRAM requirements reasonable(6GB).

On the video: You're absolutely right Ive been staring at this for months and forgot what it looks like to someone seeing it fresh. The lack of audio and the jumpy editing makes it hard to follow the actual workflow there are more videos on the website 5 in total I'll redo the demo with: - Narration or at least on-screen captions explaining each step - Slower pacing on the important bits (the parsing LLM rule generation flow) - A clear "here's the input here's what Syd does here's the output" structure - Maybe a side-by-side showing manual workflow vs. Syd's automation

  The automation is the whole point—scan directory, hit YARA match, auto-parse, explain in plain English, suggest next steps—and the current video completely fails to demonstrate that smoothly.

On the payment page: Fair point. It's bare-bones right now because I've been heads-down on the tool itself, but that doesn't inspire confidence if you're considering backing it. I'll add: - Current development status (what's working today vs. what's planned) - Roadmap with realistic timelines - Maybe a shorter "state of the project" video or changelog - Clearer communication on what backers get and when you will recieve weekly or monthly updates and obviously ill answer any questions

Current state for transparency: - Core features working: YARA, Nmap, Volatility, Metasploit, PCAP analysis with RAG-enhanced explanations - 356k chunk knowledge base indexed and searchable - Exploit/CVE database integrated - GUI and CLI both functional - Still refining: UX polish, additional tool integrations, documentation

I'm actively developing this (clearly evidenced by me responding to HN feedback at [current time 10:38am). The idea of local LLM + security tool orchestration is genuinely useful—I use it daily—but I need to do a better job showing how it's useful and building confidence that it's not vaporware.

  Thanks for being direct. This kind of feedback makes the product better. I'll update the demo and payment page this week and can ping you when it's improved if you're interested. and if you sign up on the website thats a great way for me to keep in touch

Thanks for the links different project though. Those are sandboxing and syscall-monitoring tools, while my Syd is an offline AI assistant built for security workflows (DFIR, pentesting, malware triage, tool-output reasoning, etc.).

Completely unrelated codebases, just happens to share the same name.

Author here. Happy to answer questions!

A bit more context on how Syd works: it uses Dolphin Llama 3 (dolphin-2.9-llama3-8b) running locally via llama-cpp-python. You'll need about 12-14GB RAM when the model is loaded, plus ~8GB disk space for the base system (models, FAISS index, CVE database). The full exploit database is an optional 208GB add-on.

What makes this different from just wrapping an LLM, the core challenge wasn't the AI—it was making security tools output data that an LLM can actually understand tools like YARA, Volatility, and Nmap output unstructured text with inconsistent formats. I built parsers that convert this into structured JSON, which the LLM can then reason about intelligently. Without that layer, you get hallucinations and garbage analysis.

Current tool integrations: - Red Team: Nmap (with CVE correlation), Metasploit, Sliver C2, exploit database lookup - Blue Team: Volatility 3 (memory forensics), YARA (malware detection), Chainsaw (Windows event log analysis), PCAP analysis, Zeek, Suricata - Cross-tool intelligence: YARA detection → CVE lookup → patching steps; Nmap scan → Metasploit modules ready-to-run commands

The privacy angle exists because I couldn't paste potential malware samples, memory dumps, or customer network scans into ChatGPT without violating every security policy. Everything runs on localhost:11434—no data ever leaves your machine. For blue teamers handling sensitive investigations or red teamers on client networks, this is non-negotiable.

Real-world example from the demo syd scans a directory with YARA, hits on a custom ransomware rule, automatically looks up which CVE was exploited(EternalBlue/MS17-010), explains the matched API calls, and generates an incident response workflow—all in about 15 seconds. That beats manual analysis by a significant margin.

What I'd love feedback on:

1. Tool suggestions: What other security tools would you want orchestrated this way? I'm looking at adding Capa(malware capability detection) and potentially Ghidra integration. 2. For SOC/IR folks: How are you currently balancing AI utility with operational security? Are you just avoiding LLMs entirely, or have you found other solutions? 3. Beta testers: If you're actively doing red/blue team work and want to try this on real investigations, I'm looking for people to test and provide feedback. Especially interested in hearing what breaks or what features are missing.

  The goal isn't to replace your expertise—it's to automate the tedious parts (hex decoding, correlating CVEs,explaining regex patterns) so you can focus on the actual analysis. Think of it as having a junior analyst who never gets tired of looking up obscure Windows API calls.

  Check out sydsec.co.uk for more info, or watch the full demo at the YouTube link in the original post.