ZeroTrace: An Air-Gapped, Zero-Day Behavioral SOC Copilot

ZeroTrace is an AI-powered, local-first cybersecurity incident triage tool designed to assist developers and infrastructure teams in investigating suspicious runtime behavior while keeping sensitive data under control. Unlike traditional signature-based detection systems, ZeroTrace can handle previously unseen threats by using a locally hosted open-weight language model for analysis, triage, and investigation workflows.

The tool focuses on behavioral threat analysis, AI-assisted incident triage, a SOC dashboard, simulated incident response, and incident report generation. These key features aim to provide a cost-effective and privacy-focused solution for smaller teams, including independent DevOps engineers, boutique MSPs, small businesses, and startups.

ZeroTrace's monetization options include per-server subscriptions, installation and maintenance services, managed incident triage, and custom integrations with alerting and monitoring platforms. While the project is intended to demonstrate how local AI can support effective security investigation workflows, it does not guarantee the detection of every zero-day vulnerability or attack. Instead, its risk scores serve as triage indicators to be evaluated alongside supporting evidence.

Developers can explore the ZeroTrace project on GitHub (https://github.com/Scafo745/Zero-Day) and experience a live demo at https://zero-day-olive.vercel.app. The project's source code is available for contribution and exploration.