Haryshwa Nair

I'm building Arbiter AI, an open-source, self-hosted alert-triage engine for organizations without a dedicated SOC. It combines deterministic pre-filtering with local LLM analysis so event data never leaves the host.

I built reproducible evaluation suites across 88 event types and used larger realistic tests to challenge an initially misleading model ranking. After identifying benign-framing failures on disguised attacks, I moved attack-disguise checks into non-suppressible guardrails and added CI gates across Python 3.10–3.13.

At Deloitte India, I investigated 30–70 alerts daily in a five-person SOC supporting banking and insurance clients. I correlated logs, validated alerts against client playbooks, reduced non-actionable noise, and escalated confirmed or suspicious incidents to Tier 2 analysts.

I've also built a Docker-isolated SSH honeypot to capture adversary activity and co-built TrustKit AI, a rental-fraud copilot using live voice, vision, metadata, and external evidence. I'm curious about how security systems fail and build practical tools to test what needs to change.