SECURITY NODE
BulwarkAlpha
Local-first security intelligence. Built for control.
SEE IT IN ACTION
Watch BulwarkAlpha Work
A walkthrough of the local security node — discovery, evidence collection, AI explanation, and the approval pipeline.
01
What Is BulwarkAlpha
A security node that runs on your terms.
BulwarkAlpha runs entirely on your local machine as a Docker-based security node. It discovers devices on your network, collects Windows security evidence, and performs read-only checks on connected Microsoft, Google, and AWS services — all without sending data to the cloud.
BulwarkAI explains every finding using the actual evidence it collected, then builds hardening plans tailored to what it found. You stay in control at every step.
02 — The Architecture
How It’s Built
Docker API
Runs the entire node as isolated containers on your machine, keeping every component contained and reproducible.
Database
Stores collected evidence and findings locally, so your security history never leaves the device.
Tool Broker
Mediates every action a tool can take, enforcing a strict boundary between intent and execution.
OPA Policy Engine
Evaluates every proposed change against explicit policy rules before anything is allowed to run.
Ollama AI
Powers BulwarkAI’s reasoning entirely on-device, so prompts and evidence never touch a remote server.
Network Discovery
Maps the devices on your network so you know exactly what’s connected before any check runs.
03
Capabilities
Capabilities
01 DISCOVER
Find every device connected to your network.
02 COLLECT
Gather Windows security evidence directly from the source.
03 CHECK
Run read-only checks across Microsoft, Google, and AWS.
04 EXPLAIN
Understand every finding, grounded in the real evidence.
05 PLAN
Build hardening plans tailored to what was found.
ROADMAP
Where BulwarkAlpha Is Headed
An honest, milestone-by-milestone look at what’s being built, tested, and shipped.
PHASE 1
Make the Build Testable
Sep 21 – Oct 4, 2025
Install or update reliably, sign in, collect Windows evidence automatically, see findings and score details, and use the security architect review.
Verify the new link, email-text, and optional screen checker on the installed build.
PHASE 2
Small Read-Only Pilot
Oct 5 – 25, 2025
Give 3–5 testers a guided setup and clear coverage report.
Improve device names, discovery accuracy, assessment explanations, and error recovery based on what they encounter.
PHASE 3
Useful Guided Hardening
Oct 26 – Nov 22, 2025
Turn findings into prioritized plans with clearer disruption and recovery guidance.
Test each supported Windows action and its approval and verification flow on real pilot machines.
PHASE 4
Connected-Service Depth
Nov 23 – Dec 20, 2025
Expand and validate Microsoft, Google, and AWS checks, including permission gaps and identity settings.
Improve notifications so they point to new or worsening evidence without creating noise.
PHASE 5
Broader Beta
Q1 2027
Add individual user accounts and fresh verification for consequential changes, strengthen onboarding and support, and expand the catalog of fixed, approved actions.
Consider optional cloud assistance only with explicit data controls.
More phases coming soon.
04 — Control
How security changes happen.
Nothing changes on your systems without passing through a deliberate, reviewable path. Every action is proposed, checked against policy, and approved by you before it runs.
STEP 01
Action Proposed
BulwarkAlpha identifies a hardening opportunity and generates a fixed, pre-defined action. No freeform commands. No improvisation. Every action is deterministic and auditable before it runs.
STEP 02
Policy Checked
The Open Policy Agent evaluates the proposed action against your local rules. If it fails the check, it stops here — no exceptions, no overrides, no workarounds.
STEP 03
You Approve
BulwarkAI presents the action and its full evidence trail in plain language. You read exactly what will change, why, and what happens if you skip it. Then you approve or reject.
No action runs without passing policy AND receiving your explicit approval. BulwarkAlpha cannot be coerced, automated past, or silently triggered.
Fixed Actions Only
Security changes are drawn from a curated library of fixed, versioned actions. BulwarkAlpha cannot generate arbitrary commands or scripts — every possible action is known and auditable before you ever run it.
Complete Evidence Trail
Every check, finding, proposed action, policy result, and approval decision is logged locally. You have a full record of what BulwarkAlpha saw, what it recommended, and what you chose to do about it.
