PhantomX

PhantomX is an AI-driven cybersecurity platform developed as part of the Adversary Emulation & Automated Detection Engineering (AEADE) project.

The platform combines multi-agent AI reasoning, automated adversary emulation, and continuous security validation to help organizations improve detection quality, reduce false positives, identify defensive weaknesses, and assess security posture through real-world attack simulation.

Unlike traditional security tools that rely on a single analysis engine, PhantomX introduces a structured decision-making model where multiple AI agents independently evaluate security events before a final verdict is produced.

At the same time, the platform continuously validates defensive capabilities through Atomic Red Team-based attack simulation and automated reporting.

Modern organizations face an increasingly complex threat landscape while security teams are expected to investigate and respond to a growing number of alerts.

Several challenges continue to impact security operations:

As a result, many organizations lack confidence in both their detection capabilities and their ability to continuously validate security controls.

PhantomX addresses these challenges through two tightly integrated components:

PhantomX ships as a complete, multi-page SOC console. Every module is live data-driven, theme-aware (light and night mode), and role-gated.

The Detection Validation Engine introduces a courtroom-inspired decision-making architecture.

Instead of relying on a single AI model, PhantomX uses specialized agents that independently evaluate the same security event.

The True Positive Agent is responsible for arguing why a security event should be considered malicious.

Responsibilities:

• IOC correlation
• Threat analysis
• MITRE ATT&CK mapping
• Risk assessment
• Evidence collection

The False Positive Agent evaluates the same event and attempts to determine whether it may represent legitimate activity.

Responsibilities:

• Context analysis
• Baseline comparison
• Environmental assessment
• Exception identification
• Benign activity validation

The Judge Agent reviews both arguments and produces the final decision.

Possible outcomes:

• True Positive
• False Positive
• Requires Further Investigation

Additional outputs include:

• Confidence score
• Supporting rationale
• Investigation recommendations
• Decision explanation

                     Security Event
                            │
                            ▼

        ┌───────────────────────────────┐
        │     Multi-Agent Analysis      │
        └───────────────────────────────┘

                 │               │

                 ▼               ▼

      True Positive Agent   False Positive Agent

                 │               │

                 └───────┬───────┘
                         ▼

                   Judge Agent

                         ▼

              Final Verdict + Score

The Adversary Emulation Engine enables organizations to continuously assess defensive readiness by executing controlled attack simulations.

Users can select assessment scopes such as:

• Standard User
• Administrator
• Domain User
• Domain Administrator
• Custom Profiles

The platform then automatically executes relevant attack techniques and evaluates defensive effectiveness.

PhantomX leverages Atomic Red Team to emulate real-world adversary behavior.

Example ATT&CK categories include:

This enables organizations to validate whether their existing controls and detections can successfully identify attacker activity.

        Selected Assessment Scope
                     │
                     ▼

         Atomic Red Team Execution
                     │
                     ▼

           Telemetry Collection
                     │
                     ▼

              JSON Processing
                     │
                     ▼

                AI Analysis
                     │
                     ▼

         HTML Security Assessment

Following adversary emulation, PhantomX automatically generates comprehensive HTML security reports.

The reporting engine is designed to reduce manual reporting effort while providing actionable information for security teams.

PhantomX is AI-provider agnostic and supports multiple deployment models.

• OpenAI
• Google Gemini
• Anthropic Claude
• Azure OpenAI

• Ollama
• Qwen
• Llama
• Mistral
• Custom Models

This flexibility allows organizations to deploy PhantomX within cloud, hybrid, or air-gapped environments.

docker compose up --build
# Frontend → http://localhost:3000   ·   Backend → http://localhost:8000/docs

# Backend
cd backend && python -m venv .venv
.venv\Scripts\activate          # *nix: source .venv/bin/activate
pip install -r requirements.txt && cp .env.example .env
uvicorn app.main:app --reload --port 8000

# Frontend
cd frontend && npm install && npm run dev   # http://localhost:5173

A one-command production stack (Nginx + FastAPI + auto-HTTPS) is included — see DEPLOY-DIGITALOCEAN.md, or on a fresh Ubuntu droplet:

curl -fsSL https://raw.githubusercontent.com/Ashurlu/PhantomX/main/deploy/remote-install.sh | bash

Default accounts: admin / admin123 (full access) · analyst / analyst123 (view-only). Change the admin password after going live.

• Alert triage
• Threat validation
• Investigation support

• Rule validation
• Detection coverage assessment
• Detection optimization

• Adversary emulation
• Security control testing

• Defensive readiness validation
• Threat simulation analysis

• Automated assessments
• Security reporting

• Multi-agent AI implementation
• Alert validation engine

• Atomic Red Team integration
• Security validation workflows

• Enhanced reporting capabilities
• Detection engineering analytics

• SIEM integrations
• EDR integrations
• Threat intelligence enrichment

• Continuous attack simulation
• SOC analyst copilot
• Automated remediation recommendations

PhantomX aims to redefine how organizations evaluate security detections and validate defensive readiness.

By combining explainable multi-agent artificial intelligence with automated adversary emulation, the platform provides a practical approach to continuous security validation, helping organizations understand not only whether attacks can occur, but whether they can be detected and effectively investigated.