Cyber & AI

This AI agent acts like a virtual GRC analyst. It ingests security policies, compliance documentation, and risk data, then uses a retrieval-augmented architecture (RAG) to provide grounded, explainable analysis — no hallucinations.

What the agent can do:

 • Answer GRC and audit questions using source-backed policy intelligence

 • Score vendor security risk with clear strengths, weaknesses, and recommendations

 • Provide a SOC 2 coverage snapshot

 • Assess organizational maturity against NIST CSF 2.0

 • Explain every result with document sources and confidence levels

Security & trust by design:

 • Read-only, non-autonomous agent

 • Scoped task execution (no tool or command execution)

 • Safe failure behavior when information is missing

 • Aligned with OWASP Top 10 risks for LLM applications

This project demonstrates how agentic AI can meaningfully support GRC teams, reducing manual work while maintaining auditability, accuracy, and human oversight.