fernandbaldonado.com
$ whoami

Fernand Baldonado, Ph.D.

Program Manager AI Security Systems Architect
I designed an AI Security System that integrates agentic orchestration, threat detection, and response automation in a fully air-gapped environment—demonstrating how autonomous agents coordinate to turn detection into response into insight.
Cybersecurity
IT Ops
AI Architecture
Project Mgmt

Core Applications

A fully functional, air-gapped AI Security System demonstrating agentic orchestration patterns in a controlled offline environment.

What is it

live deployment

This AI Security System is a personal operating system running entirely air-gapped on local hardware. Four autonomous agents (Alpha, Beta, Gamma, Delta) coordinate across a complete infrastructure stack—executing real threat scenarios, validating response playbooks, and demonstrating how AI accelerates security workflows in a controlled, offline environment.

agentic AI orchestration threat detection infrastructure local LLM air-gapped
// key results
4
Agents deployed
<1s
Response latency
70%
API call reduction
5
Apps integrated

Selected builds

Each entry below is a real, running system — not theoretical. All systems are fully air-gapped from the public internet and built end-to-end from infrastructure through AI integration.

Core Platform

CASE-001
active / daily driver

Four autonomous agents running locally on a Beelink mini-PC, fully air-gapped. Agents coordinate in real-time via FastAPI/WebSocket chat backend, reason over MITRE ATT&CK and MITRE ATLAS threat frameworks, and synthesize findings into shared context via a persistent vault system. Includes a 3D sphere visualization showing agent activity, local text-to-speech for spoken findings, and SQLite persistence across sessions.

FastAPI WebSockets Ollama / Qwen 2.5 3B React Three.js Kokoro TTS SQLite systemd
hostBeelink SER5 Pro (local, air-gapped)
agentsAlpha (orchestration) · Beta (threat hunting) · Gamma (AI security) · Delta (QA)
inferenceOllama Qwen 2.5 3B, ~27s per reply (CPU-bound, Ryzen 5 3500U)
serviceorchestration-chat.service — active (running)
last_updatePhase F: Voice integration complete (Elara locked on Kokoro TTS)

Attack Range & Testing Infrastructure

CASE-002
active

Self-hosted infrastructure providing real threat scenarios for the agents to hunt: segmented network topology with jump box, processing layer, and isolated target VMs. Kali Linux as attacker platform. ELK stack (Elasticsearch/Kibana) ingests telemetry from three vulnerable web applications via Filebeat/Metricbeat. Atomic Red Team payloads executed and mapped to MITRE ATT&CK technique IDs. Containerized services via Docker for reproducible threat scenarios. This gives agents real logs to analyze, not synthetic sample data.

Elasticsearch / Kibana Filebeat / Metricbeat Kali Linux (attacker) Atomic Red Team DVWA Network segmentation MITRE ATT&CK
segment10.0.0.0/24 (isolated lab network)
attackerKali Linux (UTM VM, penetration testing)
targets3 web apps (DVWA) dockerized, intentional vulnerabilities
siemELK stack on Raspberry Pi, collecting 3/3 targets
statusactively ingesting logs, threat scenarios executable on demand
coveragePhase A/B complete — Phase C team dynamics in progress

Delivery Timeline

Five-phase delivery: Foundation, Agent Development, Integration, Hardening, and Testing & Deployment. Current status below.

Foundation
complete
Agent Dev
complete
Integration
complete
Hardening
complete
Testing & Deploy
adaptive
Phase breakdown
Foundation (Complete)

Network topology, infrastructure provisioning (Beelink + Raspberry Pi cluster), ELK stack setup, systemd service scaffolding.

Agent Development (Complete)

Built four autonomous agents (Alpha/Beta/Gamma/Delta), agent orchestration state machine, per-agent personas, vault memory system, MITRE ATT&CK and MITRE ATLAS reasoning.

Integration (Complete)

FastAPI backend with WebSocket protocol, React chat UI with streaming, Three.js sphere visualization, ELK telemetry pipeline, investigation grading system, Vault RAG and Command Center UI.

Hardening (Complete)

Streaming responses, Kokoro TTS voice synthesis, concurrent agent reactions (alive room), inference performance optimization, comprehensive documentation, 12+ production patches, agent personality seeding.

Testing & Deployment (In Progress)

Concurrent multi-agent room testing, agent persona refinement under load, performance benchmarking, production environment validation, live room deployment.

Core Applications

Five integrated applications powering orchestration, threat detection, response coordination, and knowledge persistence.

chat all alpha beta gamma delta Alpha: orchestrating parallel threat pass... Beta: found 3 suspicious lateral moves Gamma: AI attack detected - 92% confidence Delta: grading investigation findings... /all analyze today's threats
Chat Interface
Agent Network
Sphere Visualization
C2 DASHBOARD kali attack jump online elk online core online CPU 62% RAM 24/32 Storage 68% Kali active Threads: 4 | ELK: 156GB | Rules: 127 uptime 18d 6h | rotation: 72h
C2 Dashboard
INVESTIGATION GRADER T0012 • Lateral movement via C2 92% T0048 • Credential access - memory 87% T0056 • Defense evasion - bypass 64% T0001 • Initial access - phishing 45% Score: 72 / 100 16 of 48 techniques completed
Investigation Grader
VAULT COMMAND CENTER Alpha Findings: 12 | Relationships: 4 | 78% Beta Findings: 8 | Relationships: 2 | 52% Gamma Findings: 15 | Relationships: 6 | 91% Delta Findings: 6 | Relationships: 1 | 35% TOTAL: 41 findings | 13 relationships | 4 personas Updated live
Vault System