# ZeroTrace: An Air-Gapped, Zero-Day Behavioral SOC Copilot

> Source: <https://dev.to/navneet_sinha/zerotrace-an-air-gapped-zero-day-behavioral-soc-copilot-db2>
> Published: 2026-10-18 04:03:26+00:00

*This is a submission for the [Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle](https://dev.to/challenges/hacktoberfest-week2-2026-10-12)*

Modern cybersecurity threats are evolving rapidly, but advanced security monitoring and Endpoint Detection and Response (EDR) solutions can be expensive and complex for independent DevOps engineers, freelancers, and small infrastructure teams. Traditional signature-based detection can also struggle with previously unseen threats for which no known signature exists.

**ZeroTrace** is an AI-assisted, local-first cybersecurity incident triage copilot designed to help developers and infrastructure teams investigate suspicious runtime behavior while keeping sensitive telemetry under their control.

Instead of relying entirely on external AI APIs, ZeroTrace uses a locally hosted open-weight language model to assist with incident analysis, risk assessment, and investigation workflows.

The goal is simple: make intelligent security triage more accessible, privacy-conscious, and affordable for smaller teams.

ZeroTrace is designed to support behavioral investigation, not to guarantee the detection of every zero-day vulnerability or attack. Its risk scores are triage indicators that should be evaluated alongside supporting evidence.

ZeroTrace is designed around the needs of users who require practical security visibility without the complexity and cost of a large enterprise security stack.

**Potential customers include:**

ZeroTrace could support several monetization models:

For example, a freelancer could explore a proposed $29–$49 per-server monthly package or offer a managed security service with customized pricing.

These figures are illustrative business hypotheses, not validated market demand. Actual pricing would depend on infrastructure costs, support requirements, features, and customer feedback.

ZeroTrace is intended to demonstrate how local AI can support a practical security investigation workflow through a dedicated SOC dashboard.

The objective is to make security investigation easier to understand, review, and document without requiring every user to operate a complex enterprise SOC platform.

**Demo resources**

The ZeroTrace project repository contains the source code

 [and implementation details for exploring the application and contributing to its development.](https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Flb0mwy7r1wcgo08kq6jx.png)

**GitHub:** [https://github.com/Scafo745/Zero-Day](https://github.com/Scafo745/Zero-Day)

**Autonomous Zero-Day Exploit Detection & Real-Time Forensic Analyst Engine**

*Powered by Local Air-Gapped Gemma 4, Server-Sent Events (SSE), and a Bauhaus Constructivist SOC Dashboard.*

| Component | Platform | URL | Health / Status | 
|---|---|---|---|
| **Frontend SOC Dashboard** | **Vercel** | [https://zero-day-olive.vercel.app](https://zero-day-olive.vercel.app) | Production App Router (Next.js 15) | 
| **Backend Telemetry API** | **Render** | [https://zero-day-cj0b.onrender.com](https://zero-day-cj0b.onrender.com) | [`/api/health`](https://zero-day-cj0b.onrender.com/api/health) | 

Traditional Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms rely on static hashes and known CVE signatures. Consequently, **zero-day exploits and novel supply-chain attacks bypass legacy defenses by definition**.

**ZeroTrace** flips the paradigm from signature scanning to **pure behavioral provenance reasoning**. By ingesting raw kernel and process execution telemetry (process lineage, command flags, sensitive file reads, and outbound network socket operations), ZeroTrace utilizes a locally hosted, GPU-accelerated **Gemma 4** model (`zerotrace-analyst`) to autonomously deduce adversary intent in real time without external cloud dependency.

Developers can explore the repository, review the architecture, report bugs, suggest improvements, and contribute to making local-first security investigation more accessible.

ZeroTrace brings together modern web technologies, security telemetry workflows, and locally hosted AI to explore a privacy-conscious approach to incident investigation.

The project uses a local-model architecture based on Ollama, allowing compatible open-weight models to run on the host machine rather than requiring an external inference API for every analysis request.

This approach can reduce recurring inference costs and limit the exposure of sensitive security telemetry to third-party AI providers.

The core workflow focuses on turning technical events into information that an operator can investigate.

A conceptual pipeline looks like this:

**Runtime Telemetry → Event Normalization → Behavioral Analysis → AI-Assisted Triage → Structured Incident → SOC Dashboard**

The quality of each assessment depends on the telemetry available, the analysis logic, and the model's output. Any automated conclusions should remain reviewable by a human operator.

The project is designed around a modern web application architecture.

The repository is the source of truth for the exact versions, available integrations, and completed implementation details.

Security tooling must remain useful even when the AI component is unavailable.

A deterministic fallback strategy is a valuable design direction because it can preserve basic event handling when model inference fails. Similarly, containment actions should be protected by authorization, validation, audit logging, and safeguards against disrupting legitimate processes.

ZeroTrace's long-term goal is to combine useful AI-assisted explanations with transparent evidence and predictable incident-handling workflows.

Open innovation is central to the ZeroTrace concept because security infrastructure requires control, adaptability, and careful handling of sensitive information.

Security telemetry can contain command-line arguments, internal IP addresses, file paths, process information, and other sensitive operational details.

A local-first architecture can reduce the need to transmit this information to external AI services. However, achieving a genuinely air-gapped deployment also requires controlling application networking, dependency downloads, model distribution, updates, and external integrations.

Local inference is a privacy advantage, not an automatic guarantee of regulatory compliance.

Per-request inference charges can become an additional operating expense for a security service that processes frequent events.

Using a locally hosted open-weight model can eliminate external API inference fees, although it still requires suitable hardware, electricity, storage, configuration, and maintenance.

For freelancers and small service providers, this creates an opportunity to experiment with security automation without making every analysis dependent on a paid external API.

Open-weight models and self-hosted components offer opportunities to customize analysis workflows, control model selection, and adapt integrations to specific infrastructure requirements.

They also provide greater flexibility when building tools for specialized cybersecurity workflows.

Model licenses, hardware requirements, security controls, and operational limitations still need to be evaluated before deployment.

Open-source development allows independent developers, students, infrastructure engineers, and security researchers to inspect implementations, suggest improvements, and contribute new capabilities.

ZeroTrace aims to explore how these collaborative advantages can make AI-assisted incident investigation more approachable for teams that cannot justify a complex enterprise security stack.

ZeroTrace is being developed around a practical question:

**Can locally hosted AI make suspicious-event investigation more accessible to small infrastructure teams without unnecessarily exposing their operational data?**

The next step is to validate this idea with independent DevOps engineers, sysadmins, and small managed service providers.

Important questions include:

Potential future improvements include Slack and PagerDuty webhook alerts, improved incident correlation, configurable risk thresholds, additional telemetry sources, and stronger deployment hardening.

These are future directions rather than claims that every integration is already available.

Feedback from real users will help determine which capabilities should be prioritized and whether the proposed business model solves a sufficiently valuable problem.

The next phase of ZeroTrace focuses on improving the usefulness, reliability, and accessibility of local-first security triage.

Potential areas of development include:

The long-term vision is to make AI-assisted security investigation more practical for independent infrastructure operators without treating an AI-generated verdict as a substitute for evidence or human judgment.

**Hacktoberfest Open-Source AI Challenge — Week 2: Side Hustle**

ZeroTrace explores the intersection of open-source AI, cybersecurity, privacy-conscious infrastructure, and a potential sustainable business model for independent developers.

If you're interested in local AI, DevSecOps, threat detection, or open-source security tooling, check out the repository and share your feedback.

Let's make security investigation more accessible, transparent, and privacy-conscious. 🚀