I did not set out to build an autonomous security system.
I needed my infrastructure to stay alive.
My work runs across a distributed mesh of servers, websites, APIs, data pipelines, and agents. I operate much of it remotely, often through a Telegram interface on my phone. When something failed, I needed to know immediately. When I was away from a computer, I still needed a way to understand the problem and act.
The first version of Aegis was built around that need. It watched the mesh.
Then the problem changed.
Keeping a system online was no longer enough. The system needed to understand when it was being attacked, distinguish hostile behavior from ordinary traffic, contain threats across multiple nodes, and do all of that without turning an AI model into an unrestrained root user.
That is how Aegis evolved.
Today, Aegis is a bounded, evidence-gated autonomous defense system operating across five nodes and 51 Cloudflare zones. It watches the estate, investigates suspicious activity, proposes actions, verifies evidence, enforces policy, tests its own defenses, learns from attacks, and reports what happened.
Most importantly, it does not confuse intelligence with authority.
Aegis started as an operational awareness layer.
It checked whether sites were available, whether TLS certificates were approaching expiry, whether canonical and indexing directives remained correct, and whether a domain could bypass Cloudflare and expose its origin directly.
The alerting was designed to be quiet. Aegis reports a transition when something breaks and another when it recovers. It does not send the same failure every few minutes until an important alert becomes background noise.
That basic model established the first principle of Aegis: useful autonomy begins with reliable observation.
If the system cannot accurately describe what is happening, it has no business taking action.
The evolution from monitoring to defense became necessary during the recovery of a compromised WordPress installation.
The attacker had placed ten backdoors inside plugin directories and added doorway pages at the document root. The implants were deliberately ordinary-looking. PHP files were tucked into asset and image directories with names that resembled legitimate cache managers and security helpers.
WordPress core remained untouched. The wp-admin and wp-includes directories were byte-identical to a pristine installation.
That was the clever part.
Many WordPress integrity checks focus on core because core has a known checksum baseline. Plugin directories are more complicated. They change frequently, contain third-party code, and often accumulate files that nobody recognizes. The attacker used that ambiguity as camouflage.
The database survived. Hundreds of posts, bookings, orders, and SEO descriptions remained intact, which made recovery possible. But the incident exposed the limit of traditional monitoring. A site could return HTTP 200, present a valid certificate, and look healthy while quietly containing multiple persistence mechanisms.
Aegis had to learn the difference between availability and integrity.
It also had to learn that different systems deserve different levels of suspicion. A hardened application and a previously compromised WordPress installation should not receive identical monitoring simply for the sake of symmetry. Security controls should follow risk.
The WordPress host now receives dedicated file-integrity monitoring, plugin lifecycle checks, targeted tamper detection, and a more aggressive threat profile. It is treated as an untrusted tenant inside a protected estate.
The rest of the mesh does not inherit its risk.
Aegis observes live request traffic across the mesh through Nginx logs. It also maintains decoy endpoints for paths such as exposed environment files and Git configuration.
Normal visitors have no reason to request those resources. Scanners do.
When someone touches a decoy, the request becomes more than another line in an access log. It becomes structured evidence. The source, path, response, timing, user agent, related requests, and known technique are preserved for analysis.
Aegis also supports targeted on-demand checks. I can ask it to inspect a URL, perform a security assessment, or evaluate a particular IP and user agent. This turns the same system that watches continuously into an investigative interface when something deserves human attention.
Not every security decision requires the same kind of reasoning.
Aegis therefore operates at two speeds.
The reflex layer handles behavior with essentially no legitimate interpretation. Requests for sensitive files, known secret paths, and explicit honeypot resources can trigger a deterministic response immediately. There is no need to wait for a language model to explain why someone requested /.git/config.
The judgment layer handles ambiguous traffic. Every 30 minutes, it groups suspicious activity by source and asks an LLM to classify the behavior as harmful or benign. That reasoning is grounded in Aegis’s own technique corpus, current threat intelligence, severity data, and the dependency graph of the systems being protected.
The distinction matters.
Fast deterministic controls handle the obvious cases. Contextual reasoning handles behavior that requires interpretation. Neither is forced to do the other’s job.
The most important boundary in Aegis is the separation between judgment and enforcement.
The LLM can investigate activity, name techniques, assign confidence, explain its reasoning, and propose a ban. It cannot execute the ban itself.
A separate root-level executor evaluates the proposal against deterministic policy. It checks hard allowlists for infrastructure addresses, Cloudflare ranges, mesh nodes, and verified crawlers. It also applies per-run limits, daily caps, per-IP cooldowns, and other blast-radius controls.
Ambiguous traffic cannot be banned on model opinion alone. A judgment must agree with deterministic corroboration such as honeypot contact, repeated failures, or a defined request-volume threshold.
Only then can enforcement occur.
Confirmed bans are applied at both layers of the perimeter. The source is blocked locally through fail2ban and at the edge through Cloudflare. A shared ban ledger distributes the decision across all five nodes, so an attacker identified on one property does not receive a fresh opportunity on another.
Every ban is recorded and reversible.
If the judgment layer becomes unavailable, discretionary enforcement stops while deterministic reflex protections remain active. A kill switch can disarm enforcement completely. The system is designed to fail safely because an unavailable model should not become an excuse for uncontrolled action.
No detection system is credible because it claims to be perfect.
It becomes credible when mistakes are contained.
During one live run, two legitimate Photon crawlers displayed behavior suspicious enough to reach Aegis’s triage layer. The classification was wrong. The architecture prevented that error from becoming a harmful action.
The crawlers produced a log entry and a detection improvement. They did not become two banned customers.
That is why corroboration gates, allowlists, shadow testing, reversibility, and blast-radius limits are not secondary safeguards. They are the foundation that makes autonomous reasoning usable in production.
An intelligent system will sometimes be wrong. A safe system controls what being wrong is allowed to cost.
Aegis does not discard hostile traffic after blocking it.
Every honeypot hit is tagged by technique, ranked by severity, and retained in a durable corpus for approximately four months. Over time, this becomes a record of what actually attacks this infrastructure rather than a generic list of what might attack systems somewhere on the internet.
That distinction is valuable.
Public threat intelligence describes the wider environment. Aegis’s own corpus describes the pressure being applied to this particular mesh.
Candidate detection signatures are introduced in shadow mode. They record what they would have banned without taking action. I can then inspect their performance, identify false positives, and promote only the signatures that demonstrate clean behavior.
The system learns continuously, but new knowledge does not automatically acquire authority.
Aegis ingests scheduled intelligence from MITRE ATT&CK, MITRE ATLAS, CAPEC, CISA’s Known Exploited Vulnerabilities catalog, the National Vulnerability Database, Nuclei, and the IACR Cryptology ePrint Archive.
Simply collecting feeds would create noise. Aegis diffs each pull against its previous state and cross-references new information with the mesh’s actual dependency graph.
The daily digest therefore focuses on what changed and what touches the stack.
A new vulnerability in software we do not run is not an emergency. A newly exploited vulnerability in a dependency exposed by one of our services is.
Because the mesh also carries post-quantum cryptographic work, Aegis monitors relevant cryptanalysis and new research in that area. The same dependency-aware model applies. The objective is not to know everything published each day. It is to identify what changes the risk of systems we actually operate.
Once attacker-controlled data flows into an LLM, the autonomy layer becomes part of the security boundary.
A malicious request path, user agent, payload, or log entry could contain text designed to manipulate the model. Aegis therefore inspects incoming data for prompt injection, jailbreak attempts, extraction attempts, and other forms of agent manipulation at both the triage layer and the LLM gateway.
Detection is useful, but isolation is stronger.
Attacker-controlled content remains untrusted data. It cannot rewrite policy, grant itself privileges, or instruct the executor. The model can interpret the evidence, but the evidence cannot become authority merely because it contains imperative language.
This is the same principle that governs the rest of Aegis. Reasoning and execution remain separate.
Every morning, Aegis runs a controlled red-team assessment across the estate.
Each property receives a grade and a count of critical issues and warnings. The report shows regressions, highlights weakened controls, and identifies where risk differs between services.
The tests are designed to verify defenses without becoming permanent attack surface. New checks are bounded, controlled, and removed when their purpose is complete.
This creates a daily answer to a question most infrastructure teams struggle to answer:
Do the protections we believe exist still work today?
A configuration can drift. A deployment can expose an origin. A plugin can become dormant. A certificate can approach expiry. A security header can disappear. Aegis does not assume yesterday’s state survived today’s changes.
It checks.
I operate Aegis through a remote agent session connected to Telegram, but Telegram is only the interface. The system’s real advantage is shared operational memory.
Alerts, investigations, proposed actions, approvals, rejected decisions, test results, and corrections become part of the same durable context. The agent does not wake up stateless for every incident. It knows how the mesh behaves, what has attacked it, which actions succeeded, where mistakes occurred, and how I have chosen to respond.
That memory improves judgment, but it does not grant permission.
Memory describes what happened. Policy decides what may happen.
This separation allows the system to become more informed over time without allowing accumulated context to become accumulated privilege.
Aegis runs live across the mesh, with its primary reasoning layer in Helsinki and enforcement distributed through Oregon, Singapore, Ashburn, and Nuremberg. I operate it from Falkenstein, often through my phone.
The architecture is also packaged as the aegis-intake SDK for intake.dental.
That packaging matters because it proves Aegis is no longer only a collection of scripts tailored to my personal infrastructure. Its core model can be transferred:
Those principles apply beyond this mesh.
Aegis began as a way to know when something broke.
It became a way to understand why.
Then it became a way to recognize an attack, contain it across a distributed estate, learn from the attempt, verify that the defenses still work, and explain every decision it made.
The goal is not to remove humans from security. The goal is to place human judgment where it has the most value while giving machines responsibility for continuous observation, correlation, testing, and bounded response.
Aegis watches while I work. It watches while I sleep. It does not panic, forget to check a log, or ignore a certificate because another task became urgent.
But it also does not possess unrestricted power.
That is how Aegis guards the mesh.
Intelligence can propose. Evidence must corroborate. Policy grants authority. Every action remains bounded, reversible, and auditable.