IncidentGym build log
The build journey of IncidentGym — the gym for incident response, a project I started for the #H0Hackathon (Vercel + AWS Databases). Security teams drill realistic breaches and get a readiness score that's computed from their environment and audited in Amazon Aurora — not graded on how plausible the prose sounds. These are the engineering decisions that made the score defensible: deterministic scoring, composite-FK tenant isolation, and a blast-radius replay over the real dependency graph.
Dispatches
04 LOGGEDWatch the blast radius go from 46% to 10%.
A deterministic score is defensible but it isn't visceral — so we render it. The Blast-Radius Replay plays the incident across the service-dependency graph for your environment, persisted in Amazon Aurora PostgreSQL, red where it spread and cyan where you contained it, turn by turn. Because the resolver is pure, the debrief re-runs the moves you didn't make to show the best alternative and a why-each-number-moved causal chain — all computed-on-read, no LLM, no writes, and reproducible because the same inputs always produce the same score.
Read dispatch →A cross-tenant write should be a database error, not a code review.
Multi-tenant isolation enforced only in application code is one forgotten WHERE clause from a cross-tenant leak. So we stopped trusting code review for it. In IncidentGym every row carries an orgId, every parent declares @@unique([id, orgId]), and every child binds (sessionId, orgId) as a composite foreign key into the parent's (id, orgId) — making child.orgId == parent.orgId a Postgres guarantee. A cross-tenant write isn't a missed review, it's a foreign-key error 23503. The CISO audit console has a one-click proof you can run live.
Read dispatch →The LLM writes the story. A pure function writes the score.
AI graders that ask an LLM 'how plausible does this answer sound?' have a credibility hole: plausible prose is not a contained breach. So we split the work. The LLM writes the narrative and plays the advisor personas. A pure graph-cascade resolver — no LLM, no clock, no randomness — computes the score from your environment. Same inputs, same score. That's not a feature; for a regulated buyer it's the whole pitch.
Read dispatch →Why another cyber incident-response training tool?
The attack side is speeding up — security agencies and frontier labs now warn that AI is raising the volume and velocity of cyberattacks — while IR training is still an annual tabletop, or an AI grading plausible prose. We built IncidentGym to score readiness a different way: deterministically, grounded in your environment's dependency graph, auditable. The honest 'why us' isn't 'another chatbot.' It's how we score.
Read dispatch →