AI security monitoring for your website and cloud

Answering a security question about a busy website usually means opening three or four tools. The firewall rules are in one console, the traffic logs in another and the cloud accounts somewhere else, so even a simple question waits for the one person who knows them all. We built AI security monitoring for a client that answers those questions in Slack. It's an AI security analyst with access to the firewall, the edge logs and the AWS accounts, and it checks for new threats on its own every six hours.

It runs on Anthropic's Claude and a single small server. Every answer comes with the numbers behind it, the time window and the filters it used, so anyone on the team can check the work. It also shows what each answer cost to produce.

What you can ask an AI security analyst

The team asks in plain English. Questions like these:

• "Who is scraping the site today?"
• "Why is this university's network being blocked?"
• "Did anything change in our AWS accounts overnight?"
• "Is that visitor really Googlebot?"

If a request was blocked, the answer names the rule that blocked it, such as "IP reputation: DoS Attackers, High Threat". If traffic looks unusual, it says how today compares with the same hours a week earlier.

What our AI security monitoring connects to

The CDN and web application firewall

For this client, that's Akamai. The analyst has read-only access to the security configuration and its full version history: rate limits, IP reputation, bot management, custom rules and the block and allow lists. It also reads Akamai's security analytics reports.

Edge logs

The client's Akamai edge logs reach Elasticsearch about 90 seconds after each request. The analyst queries them directly and breaks traffic down by network, country, browser, page, security rule and response. It compares what it finds with the same hours a week earlier, so a spike is measured against normal traffic.

AWS security monitoring

In the security channel and during its scheduled sweeps, the analyst has read-only access to the client's AWS accounts. It signs in with IAM Roles Anywhere and a certificate, so no access keys are stored. It reviews CloudTrail activity, GuardDuty findings, IAM and access changes, console sign-ins and unfamiliar callers. Routine activity, such as Terraform deploys and monitoring agents, is reported apart from the changes a person needs to look at.

Bot traffic and fake crawlers

A visitor that calls itself Googlebot or Bingbot isn't always the real crawler. The analyst checks, using the address ranges Google and Microsoft publish and a reverse DNS lookup. A scraper borrowing a crawler's name shows up as a scraper, and the real search engines stay off the block lists.

It remembers what it has already found

The analyst keeps its own database, backed up daily. It records:

• findings, each with a fixed name and a status
• known actors, such as legitimate crawlers
• every sweep, with its time window and summary
• every block-list change, from proposal through approval to completion
• an audit log of its conversations

Before it reports anything as new, it checks what it already knows. If an issue is already on record, it reports how the issue has changed, so the team can follow a problem over days and weeks.

Security sweeps every six hours

Every six hours, the analyst runs a fixed set of checks across the edge logs and AWS and compares the results with the same hours a week earlier. It posts a short report to the security channel, rated high, medium or low. A high rating tags the person who owns security.

The guardrails we built in

An AI agent that can see your firewall and your cloud accounts needs firm limits. These are the ones we put on this one:

• Access is read-only. The analyst can't change Akamai, AWS, Elasticsearch or Slack settings.
• The one action it can take is proposing to add or remove an entry on the IP or network block lists. A second person has to approve the proposal in Slack, and nobody can approve their own request. Separate code then applies the change, to staging first and then to production, and every applied change can be undone the same way.
• Block proposals that would affect major platforms or ISPs, verified search engine crawlers, or networks the client's signed-in customers use are refused automatically.
• User IDs, cookies and analytics IDs can be counted but never listed, and they're removed from any example records it shows.
• Log content is treated as data, which protects against prompt injection. Text someone plants in a browser string or a URL can't change what the analyst does.
• Every deploy runs a health check that confirms each credential still has only the access it should.

What it costs to run

The analyst runs on one small server. The AI model is billed by usage, so the running cost depends on how many questions the team asks and how much data each sweep reads. Each answer shows its own cost.

Who it suits, and who it doesn't

It suits organisations that run a busy website behind a CDN or web application firewall, keep their logs somewhere searchable, and have someone responsible for security who doesn't have time to check every console every day. That person, and anyone else on the team, gets answers without opening four consoles.

It doesn't replace a security team or managed SOC services. It flags problems and proposes blocks, and a person still decides what happens next. If you need people watching around the clock and responding to incidents, you need a managed security provider. An AI analyst can work alongside one and give your own team a direct way to ask what's going on.

How we'd build one for you

Your setup won't match this client's exactly, so we start with what you run.

1. We look at your CDN or firewall, where your logs go, your cloud accounts and the chat tool your team uses.
2. We tell you what we can connect with read-only access, and give you a price and a time frame.
3. We build it with the guardrails above and test it with your team.
4. Once it's running, we look after it, either as issues come up or on a retainer.

We also build AI automation for other parts of a business, and look after AWS accounts through our DevOps service. Our guide to AI agents for business explains why we keep agents on a short leash.

Questions about AI security monitoring