NCG Four guardians. One incident.
NeuralCiberGuard builds GuardEndDev Suite (GEDS) — the dashboard: four surfaces, one incident. Endpoint, mobile with the Senior anti-scam mode, network, and the Securing Web Extension at your site's edge. Endpoints are enrolled and inventoried from that one dashboard — a Sentry sensor is provisioned at the bench instead — under one tenant boundary the database enforces rather than the application. Enterprise-grade defence, priced for small business, built in the open by four security students.
Nathaniel · Nicholas · Charles · Abdel — four students, one surface each
Every surface · one correlated incident
Pick a surface. They are all managed from one place.
Each Guardian protects one surface of a small business. An endpoint is added once, from the Dashboard's admin panel, and is handed a credential shown exactly once — so every event it later sends arrives attached to a known device, inside a tenant no other customer's query can reach. A correlation engine groups a device's alerts into one incident instead of a stream of notifications, and a read-only AI assistant explains it in plain English.
Guardian Desktop
Linux endpoint detection and response. Seven MITRE ATT&CK-mapped signature rules run over the process table on every polling pass from user space, under a hardened systemd unit — each rule reports the first process that trips it. Command lines are redacted before they leave the host; containment is decided and recorded, never enforced. An IsolationForest anomaly model is demonstrated in the agent's --demo mode; training and shipping one for an installed host is not built. Enrolled and versioned from the Dashboard, where its product entitlement can be revoked.
See the agent → Android · Senior modeGuardian Mobile + Senior
One scam-detection engine, running on the device — the message text is never sent anywhere. Senior is the accessibility-first mode of the same app for adults 65+: three named signals, a fixed plain-language sentence instead of a score, and a one-button family alert that carries no message text at all. The web version is built and served by the Dashboard — its hostname still needs a DNS record before it resolves; the Android build has never been compiled.
See Mobile + Senior → Pi 5 + Pico 2 WGuardian Sentry
Two boards, one sensor. A Raspberry Pi 5 runs the detection stack — five decoy services whose first visitor is your first alert, Wi-Fi evil-twin and deauth-flood watch, and a fixed-frequency RF energy check at the centre of each band the tuner can reach, against a learned baseline — and reports over a signed, replay-protected uplink. A Pico 2 W is the field annunciator, and beacons on its own LoRa radio. Sentry watches the segment that cannot run an agent.
Meet Sentry → Auth-gated · AI-assistedGuardian Dashboard
The control plane, and the one place every endpoint is managed from once enrolled: device inventory with last check-in, a per-product kill switch, and a hash-chained audit log the application can append to and read but never edit or erase. The Securing Web Extension is the fourth surface — edge protection on your site's own Cloudflare zone, not a browser add-on: WAF / IDS / IPS and virtual-patching rules, bad-bot blocking, optional geo controls.
See the Dashboard →Senior, in a browser — nothing to install
Senior is a mode, not a separate product. The web version — served by the Guardian Dashboard, nothing to install — is built and served; the Android mode is the same detection engine, ported line for line, and has never been compiled. From Dashboard → Settings → Senior a family member sets who the family alert reaches, how often it may fire, and the verified contact list — so it is set up on someone else's behalf and the person being protected never has to open a settings screen.
Before you follow that first link: dashboard-geds.neuralciberguard.org
still needs its DNS record configured. Until that record exists the address will not resolve.
The browser demo on the GEDS hub works today.
There is no public Guardian download yet. On a version tag the
pipeline builds the .deb, writes a SHA256SUMS manifest, detach-signs it with the release
GPG key and verifies that signature inside the same job — but it publishes job artifacts, not a release,
and the release key is cut with Release 1. When there is a release you will check the signature, then the
checksum: the procedure, written down now ·
how each product will reach you.
Built against published standards — not against a customer list
- MITRE ATT&CK Enterprise v19.1 The technique IDs the Guardian Desktop detection rules map to, and the technique set the training missions are written from.
- OWASP Top 10 · ASVS The rule families in the Securing Web Extension, and the review checklist for the dashboard's own application code.
- NIST CSF · SP 800-61 Identify / Protect / Detect / Respond / Recover as the incident vocabulary, and the response lifecycle the AI assistant explains against.
- PIPEDA + WCAG 2.2 AA Canadian privacy law as the data-minimisation floor, and WCAG 2.2 AA as the accessibility floor — the Senior mode is measured against it, not retrofitted to it.
These are the frameworks the work is measured against. They are not endorsements, certifications or partnerships, and none of these organisations has reviewed this project.
The front door.
One free account signs you into the games hub, and will gate Guardian downloads once there is a release to gate. A monthly Supporter plan funds the build and adds early access. Each NCG site keeps its own session — accounts never share cookies across origins, by design.
Status · Connecting
Accounts open with the showcase build.
The sign-in you see here goes live the moment our account service is connected — until then nothing on this page pretends to work. Games stay open to everyone in the meantime.
Free
$0 · forever- Every training game on the games hub
- The verification guide today; Guardian product downloads once released
- Your username on future leaderboards
Supporter
$5/mo CAD- Everything in Free
- Funds the capstone — you appear on the open ledger (never by name)
- Early access to new games & Guardian previews
- Cancel any time on Stripe's own pages
Card details never touch this site — checkout runs on Stripe. New Supporter plans are activated by the team within 24 hours while we're pre-launch.
Four students, one security suite.
Four students on one team — each owning one surface of GEDS, all four reporting to the same dashboard.
Nathaniel
- Project lead
- Linux endpoint agent, 7 MITRE ATT&CK rules
- IsolationForest anomaly model (runs in demo mode)
- Redaction at the point of collection
- Malware analysis, forensics
Nicholas
- On-device scam-SMS detection
- Addresses redacted before any request
- Senior — accessibility-first anti-scam mode
Charles
- Raspberry Pi deception tripwire
- Honeypot, Wi-Fi and RF sensing
- Signed uplink, LoRa field node
- Network security, hardware
Abdel
- Multi-tenant dashboard
- AI incident-response assistant
- Securing Web Extension — WAF / IDS / IPS at the edge
Skills & Tools
The combined proficiency across the team, and the tools we actually work with.
GitHub Foundations
GitHub · 2025 · Completed
AZ-900 · AZ-500
Microsoft Azure · In progress
CCNA 200-301
Cisco · In progress
CompTIA CySA+
CompTIA · Planned
SSCP
ISC2 · Planned
GIAC GSEC
GIAC · Planned
The NCG terminal.
A live shell we built for this site — type a command to explore the team, the products, and the build. Try help.
A real interactive component — commands run in your browser, nothing is sent anywhere.
Selected Projects
Academic and operational security work — from penetration testing to two years of production defence.
Classes & Roadmap
A structured path through the program — expand any phase for the detail.
Isolated lab built with virtual machines, Kali Linux, Windows Server, and a structured project repository. Public portfolio online.
Networking fundamentals, OS internals, and computer architecture. Cisco Packet Tracer labs, IP addressing, ACLs, subnetting.
Attack/defence techniques, web vulnerabilities (DAST), and security practice within the Canadian legal context.
Social engineering, compliance and encryption, and scripting for security tooling.
Governance frameworks, policy writing, risk-assessment methodology, and the statistical thinking behind data-driven security decisions.
Wireless attack vectors (WPA2 cracking, rogue APs), IoT attack surface, and OS-level exploitation techniques.
Static/dynamic malware analysis, PC-format & sandboxing, disk/memory forensics, and evidence chain of custody.
Cloud security focus, detection engineering, and the capstone showcase (Aug 2026): first green pipeline, Sentry on real hardware, signed release.
The threat landscape, live.
What's being exploited right now, what just landed as critical, and what the field is talking about — pulled straight from the primary sources in your browser. No account, no cookies, no tracking: your browser talks to CISA, NVD, and Hacker News directly, and nothing you read here is logged by us.
Actively exploited
source · CISA KEVCritical, this fortnight
source · NVD · CVSS v3Security news, live
source · Hacker News · community-rankedFeeds refresh every 10 minutes while the page is open, pause in hidden tabs, and keep a short local cache so we stay polite to public APIs. If a source is unreachable, the board says so — nothing here fakes liveness.
Live feed embedded from Check Point's public ThreatMap. If it doesn't load in your browser, open threatmap.checkpoint.com directly.
r/cybersecurity
The largest practitioner-run community — tools, careers, and breaking news, unfiltered.
Wired Security
Long-form journalism on state-sponsored attacks, zero-days, and policy.
The Hacker News
High-volume threat intelligence and CVE coverage — active exploits and new malware.
Krebs on Security
Brian Krebs — the gold standard in cybercrime investigation, fraud, and botnets.
BleepingComputer
Best technical coverage of ransomware campaigns, malware analysis, and Windows security.
SANS ISC
Daily threat diaries from SANS instructors — technical, dense, and current.
Dark Reading
Enterprise threat intelligence and vendor research — the business side of security.
Cybernews
Fast-moving daily coverage of data breaches, ransomware, and threat-actor activity.
Cybersecurity Tools Lab
Professional-grade tools across network security, application testing, cloud defence, incident response, SIEM/SOC, threat intelligence, OT/IoT, and forensics — every tool a working security engineer actually uses. Filter by discipline:
Showing all 68 tools
Security Training Games.
Hands-on security games for every audience — seniors and consumers, business teams, industry leaders, and a full Pro mode for practitioners. Our flagship, Ciber Traversal, leads a growing library on the games hub, alongside Career Roadster and the Phantom Chronicle Trace deduction games.
Real 2025–2026 attack techniques — ROP chains, supply-chain compromise, process injection, LotL/LOLBins — mapped to MITRE ATT&CK and the NIST NICE Workforce Framework. Live CVE feed, XP system, skill tree, and a tool arsenal.
Four modes: Professional (full security-tool guide) · Security Awareness (business fundamentals) · Senior / Consumer (GrapheneOS + consumer app guidance) · Industry Threats (sector case studies for Healthcare, Finance, Retail, Education).
Enter the Games hub →Free accounts are opening soon — every game stays open until then.
Games are free with an NCG account — create yours in a minute.
Signed in — the hub will recognise you. Have fun out there.
GuardEndDev Suite — the whole picture.
One suite, one backend, one AI assistant. Four surfaces — three protection agents and an auth-gated command centre with the Securing Web Extension built in — write into one multi-tenant alert store that the database itself keeps separated per customer. Desktop endpoints are added from that one dashboard — the mobile half is not written yet — and all four surfaces are inventoried there, and a device's detections group into one incident, not ten disconnected alerts.
Guardian Desktop
Linux endpoint detection and response — 7 MITRE ATT&CK signature rules over the process table each pass, in user space under a hardened systemd unit. Command lines redacted before they leave the host. Its IsolationForest anomaly model runs in --demo; no model is trained or shipped for an installed host yet.
Guardian Mobile + Senior
Anti-scam detection that scores message text where it sits — the text is never sent anywhere. The Senior mode adds three named signals, a fixed plain-language sentence instead of a score, and a one-button family alert that carries no message text, for adults 65+. Built and served as a web version; the Android app has never been compiled, so the on-device run and the phone's alert button are ported source, not shipping behaviour.
Guardian Sentry
Raspberry Pi 5 network sentry with a Pico 2 W field node — five decoy services, Wi-Fi evil-twin and deauth watch, a fixed-frequency RF energy check against a learned baseline, and a signed, replay-protected uplink.
Guardian Dashboard
Auth-gated, AI-assisted command centre — where endpoints are enrolled and inventoried, and where a product is killed for the whole account — with the Securing Web Extension built in: edge protection on your site's own Cloudflare zone, not a browser add-on. WAF / IDS / IPS and virtual-patching rules, bad-bot blocking, optional geo controls.
How it works
- An endpoint is enrolled once from the Dashboard's admin panel and handed a credential shown one time
- Every event is signed — endpoints by that credential, sensors and the edge by HMAC over the method, the route and the exact bytes
- Identity is read from the signature server-side, never from the request body
- Postgres row-level security isolates each customer's data at the database, not in application code
- A correlation engine groups a device's alerts inside a time window into one incident, severity taken from the worst member
- AI-IR explains it in plain English — read-only, fully audited
What we built
- Tenant isolation in the database and re-checked in the route
- One enforced AI boundary — read-only tools, injection canary
- Three revocation levers — whole product, one host, one leaked token — checked on every check-in; the product lever is the one with a Dashboard control today
- A hash-chained audit log the app can append to and read, never edit or erase — re-verifiable from the Dashboard
- Hardened systemd unit; a GitLab pipeline configured with secret scanning, SAST, dependency, container and IaC checks and an SBOM — it has not run green end to end yet
.deb for Debian and Ubuntu on amd64 — build-deb.sh and dpkg-deb are real and run in CI on a version tag, and the same tag writes a SHA256SUMS manifest, detach-signs it and re-verifies that signature in the job that produced it. Both come out as 90-day job artifacts: no pipeline job creates a GitLab Release, and the release signing key is cut with Release 1. When it is published you check the signature, then the checksum, and if either fails you do not install. The package installs a dedicated non-login service account and a hardened systemd unit. Guardian Sentry is two boards provisioned at the bench — keys are never sent over the air — and runs a hardware-free demonstration mode on any laptop today; there is no Sentry package, checksum or signature at all. Senior is built as a web version served by the Dashboard, so the person being protected will have nothing to install. The Dashboard itself has nothing to install at all — how each product will reach you.
.rpm, no install.sh, no agent container image and no Windows build — the Debian package is the whole of it, and a Dockerfile in the tree is a local test image, not a published one. Guardian Desktop's AI-EDR model is not trained or shipped for an installed host: the IsolationForest classifier is real code and it runs in --demo, trained in-process on the built-in benign baseline, but no code, packaging step, flag or job writes the model file the agent looks for, so a packaged install runs the seven signature rules alone. Its ransomware rule likewise fires on a ransom file extension only — nothing seeds the decoy files the other half of that rule looks for. Guardian Mobile has no released Android build: the detection engine is ported and the app has never been compiled, so the phone cannot yet enrol, send a family alert or ask the server for a second opinion. Sentry's flashable image, virtual sensor and syslog connector are roadmap items, not downloads, and the field node's LoRa beacon has no receiver — nothing on the Pi reads the radio, so that liveness never reaches the Dashboard. In the Dashboard, only the per-product kill switch has a control: disabling one host and revoking one leaked token are enforced at ingest but have no button, no server action and no API route. Web Watch — uptime, TLS-expiry, header, DNS and page-integrity monitoring — is designed and not implemented. The Securing Web Extension's edge rules are real Terraform an operator applies to a zone, but the job that feeds those edge events back to the Dashboard is not written, so a web attack does not yet join an endpoint's incident.
Fund the mission.
Our first milestone — $633 CAD — ships the preview app, funded by the four of us and anyone who wants in. The bar keeps climbing past it toward a $1,500 stretch goal. Every dollar appears on this live ledger within seconds; refunds drop out automatically. Payments run on Stripe’s secure pages — card details never touch this site — and the total is reported by our tracker service, never typed by hand. No contributor names are shown.
— COOKIES & PRIVACY
Small print, plainly.
Cookies: this site sets none of its own. Your THEME choice, game progress on the games hub, and your signed-in session all live in your browser's local storage for that site only — NCG origins never share cookies or sessions with each other. No analytics, no trackers, no ads. The terminal and its assistant run entirely in your browser; nothing you type there is transmitted or stored by us. Accounts: when accounts open, creating one stores exactly three things — your email, your chosen username, and your plan — with our database provider Supabase; passwords are stored only as salted hashes by that service and are never visible to us. You can ask for a copy or deletion of your data at any time: write to the team. Infrastructure: the site is served by Cloudflare, which processes standard request logs and may set strictly-necessary cookies to deliver it securely. Payments: contributions and Supporter subscriptions happen on Stripe's own pages under Stripe's privacy policy; we see the amount and the account email, nothing more — the ledger above never shows names. Contact: the form below opens your mail app — we receive only what you choose to send.
— CONTACT US
Write to the team.
Sends via your own email client — nothing is stored on this site.