An air-gapped AI security operations platform

Context

A Dubai Government entity responsible for electronic security runs a security operations centre fed by endpoint detection, a SIEM and firewall telemetry. Volume is the problem: thousands of alerts, most of them noise, and a small team that has to find the multi-vector attack hiding in them. They wanted an LLM-assisted platform for real-time detection and automated triage, with a command view that correlates across tools.

The constraint

The network is air-gapped by policy. There is no cloud model to call, no package registry, no telemetry back to a vendor. Everything I usually reach for had to be replaced by something that ships in an image and runs on hardware the client owns. That includes the model, the vector store, the evaluation pipeline, and the way updates get in.

How it works

Security tools feed a normaliser that turns vendor-specific events into one schema and stores them. The on-prem model runs on Mac Minis with MLX, which gave us usable inference on Apple silicon the client could buy, rack and keep inside the building. It reads batches of events with retrieval over playbooks and past incidents, then writes triage decisions: severity, the likely attack chain, the assets involved, and the recommended response. The command centre shows correlated incidents rather than raw alerts. Model updates arrive as signed images through the same offline process the client uses for everything else.

What I did

I designed the deployment so the entire platform, more than twenty services, runs from images alone on a bare-metal Kubernetes cluster with Helm charts per environment. I built the LLM layer: model serving, retrieval over the playbook corpus, prompt pipelines for triage, and an offline evaluation set built from the client’s own historical incidents so we could measure precision before anyone trusted the output.

I talked to the analysts who would sit in front of the command centre, and to the security lead who owned the risk. The analysts changed the output format: they did not want a paragraph, they wanted the attack chain as a list with the evidence attached. The security lead changed the deployment: signed images and a human approval step for any model update.

Outcome

The centre now triages automatically and correlates multi-vector attacks across tools that previously had to be read side by side. Analyst attention goes to the incidents the platform flags, with the evidence already gathered. It has run without an internet connection since the day it was installed, which was the point.