Building a full security stack with Claude (and a little Geeps) — 10 months ahead of sched

Building a full security stack with Claude (and a little Geeps) — 10 months ahead of schedule.

When I set out to build a graph-native security platform in the end of 2025, the target for working prototypes was year-end 2026. We hit it in February. (As well as a fully working Claude automated DevSecOps pipeline - but that was bleed over from my day job).

This is a totally new approach to cyber...

The stack:

Raz0r — Detection & Response
Ingests from Azure AD, AWS SecurityHub, and Azure Sentinel. 12 detection types map every alert signal to ATT&CK techniques and blast radius across the threat intelligence graph. Not a SIEM. Something better.

Signal — Enterprise signals Intelligence (this will be the ANTOS CI/CD pipeline dashboard)
160K+ graph nodes from NVD, MITRE, CISA KEV, OTX, and OpenCTI. ML engine runs risk propagation, community detection, GCN/GAT embeddings, and Hawkes process forecasting. Real-time visualization via ThreatGlobe.

Fusion — Enterprise Platform
Unified dashboard, threat surface profiling, public SITREP page, and multi-factor auth. The analyst's home.

All three platforms share a single Neo4j knowledge graph. An event from AWS SecurityHub connects to an ATT&CK technique, which connects to a threat actor, which connects to a campaign — one query, full context.

The entire stack — backend, frontend, ML, infrastructure, deployment — was built with and around the Claude ecosystem. Claude Code is the pair programmer. Claude API powers the AI-driven reports and analysis within the platforms.

Early days. But having three production prototypes running with real cloud telemetry, 160K+ threat intel nodes, and graph-native detection rules feels like a solid foundation.

Stack: FastAPI + Neo4j 5 + Next.js 16 + Caddy
Built with: Claude Code + Claude API
Live at: ninjasignal.ninja | ninjafusion.ninja | ninjaraz0r.ninja

scottg/out