A SOC-Grade Cyber Threat Briefing Generator — No API Key, No Dependencies

What I built

I built a tool that turns live threat intelligence into a SOC-grade cyber threat briefing, delivered as a single self-contained HTML file a security team can read or hand to leadership. It pulls current intel from authoritative sources and synthesizes it for a defender — with no install, no dependencies, and no standing API key.

• Fetches current intel live from authoritative sources — the CISA Known Exploited Vulnerabilities catalog and the National Vulnerability Database — alongside a threat-intel feed.
• Produces one self-contained briefing: executive summary, threat landscape with a "so what for defenders" line on each item, exploited and critical CVEs, indicators of compromise, MITRE ATT&CK technique mapping, and prioritized recommended actions.
• Enforces provenance: every CVE, indicator, and technique carries a source link — anything that can't be sourced is left out rather than invented.
• Runs with no secret and no dependencies, by design: a secret that doesn't exist can't be stolen, and a dependency you don't install can't carry a vulnerability.

Building it securely

Because the tool ingests untrusted, attacker-influenceable text into an AI context and then writes HTML a human opens, I treated it as a security project in its own right. I ran a NIST SP 800-30 risk assessment on it and found the top risks were indirect prompt injection and stored XSS.

Then I wired the mitigations back into the build: fetched text is treated as untrusted data and never as instructions, every fetched string is HTML-escaped before it reaches the output, a restrictive Content-Security-Policy blocks scripts inside the briefing, and a human reviews every briefing before it's published.

Why it matters

Threat briefings are usually a manual, time-consuming analyst task. This turns the repetitive assembly into a repeatable, fully-sourced, review-gated artifact — while modeling the discipline I'd want on any tool that mixes live external data with an AI: assume the input is hostile, prove every claim, and keep a human in the loop.