AEGRIX Watchman
A service on every Windows endpoint and one command console for the SOC: measured security posture, ransomware defense, hash-chained audit log.
SYSTEMS & ARTIFICIAL INTELLIGENCE ENGINEER
I’m Muzaffer Ulusoy. I build security services that run on the endpoint, AI engines that produce on their own, Windows applications, and the server infrastructure underneath them. I write the code and I keep the machine it runs on alive.
01 / SYSTEMS & APPLICATIONS
All six are in production or published as open source. What they share: each one took over work that used to be done by hand.
A service on every Windows endpoint and one command console for the SOC: measured security posture, ransomware defense, hash-chained audit log.
An AI-assisted defense system that recognizes attack tooling by behavior rather than signature. My most-starred project on GitHub.
Cleaning a production server that had a backdoor and a crypto miner on it, collecting the evidence, and permanently closing the way in.
An automation engine that crawls the site itself to find what is missing, then produces content and images across six different AI providers.
A membership platform whose blog is written and published by AI on its own, with media protected behind signed URLs on a separate server.
GPU-accelerated 4K screen recording, an offline OCR studio, and a voice-tracking teleprompter that never shows up in the recording.
02 / WHAT I BUILD
The world is moving this way: most work done by hand is becoming something AI and automation can do. I stand on the side that builds that transition — I write the software and I set up the system it runs on.
Explore all servicesProtection that runs as a Windows service, ransomware defense and an audit log that resists deletion; on the server side, hardening and real incident response.
EDR development · hardening · incident response · evidence collectionEngines that take over repetitive work: systems that write and publish on their own, multi-provider LLM infrastructure, workflows that decide and move forward.
LLM integration · agents · multi-provider setup · local modelsSoftware that runs on the machine, not in a tab: background Windows services, GPU-accelerated tools, browser extensions.
C# / .NET · Python · Windows services · Chrome MV3The layer the application stands on: isolated hosting, signed access, automated backups and monitoring that runs itself.
Nginx · Cloudflare · isolation · automated scanning03 / HOW I WORK
The reasoning behind each decision stays written down. I don’t assume it works — I verify it with my own tests and with real use.
Which part of the work repeats, where the time goes, where the risk sits — we establish that first.
Which part goes to software, which goes to AI; where the data flows and who is allowed to do what.
I build it piece by piece. Each piece arrives with its own test, and we move forward with working releases.
I handle deployment, server side included. Then I measure: the real value gets reported, not the assumed one.
MUZAFFER04 / THE PERSON BEHIND IT
Writing the software and keeping the server it runs on alive is a different thing from knowing each separately. I write the security service on the endpoint, the API that collects its data, the console in front of it, and the Linux server underneath. Cleaning a compromised server and collecting the evidence is part of the same job. My open-source work is on GitHub.
Learn moreLET’S BUILD IT
If you have a process that is manual, repetitive and eating time — or a system that needs protecting — tell me about it and I’ll build the thing that takes it over.