Real systems.
Real metrics. Real deployments.

The Problem

BOLDR Supply Co. — a 3-person support team handling 70+ tickets/week across email, WhatsApp, Instagram DM, and web chat. Every enquiry manual. Same questions recurring. Customer signals disappearing into inboxes instead of feeding marketing strategy.

What We Built

A self-improving customer intelligence engine that closes the loop between support and marketing:

• Classify and answer recurring questions automatically (71% auto-answer rate)
• Detect knowledge gaps and auto-draft new KB entries for human approval
• Cluster emerging customer themes and generate weekly marketing intelligence briefs
• Human-in-the-loop approval on every AI-drafted reply and KB update
• PII stripping (8 patterns, GDPR/PDPA-compliant), audit logging, confidence scoring

The Problem

Organisations have policy documents, SOPs, compliance standards, and incident response plans — but no way to semantically connect them. Traditional search returns chunks by keyword. Staff can't find "How does our incident response process relate to our compliance requirements?" because the answer spans multiple documents and requires understanding relationships.

What We Built

Phase 1 prototype of a graph-augmented RAG platform:

• Structural chunking for policy documents (headers, sections, tables)
• Hybrid retrieval: vector similarity (Qdrant) + BM25 keyword (OpenSearch)
• Reciprocal Rank Fusion to merge and rank results from both retrievers
• REST API: /v1/ingest, /v1/ingest/directory, /v1/search, /v1/health
• Full Docker Compose stack — one command to deploy

Phase 2 (Planned)

• Entity extraction (spaCy/GLiNER) for people, systems, controls, and processes
• Knowledge graph (Neo4j) connecting entities across documents
• Graph traversal for multi-hop reasoning ("How does X relate to Y?")
• BGE-Reranker-v2 for precision retrieval improvement

The Problem

SMEs can't afford enterprise SIEM. Consumer security products don't do monitoring. Parents want parental controls but also want enterprise-grade protection. No competitor combines both at a consumer price point.

What We Built

A managed security service platform with two product lines:

• Wazuh 4.14 SIEM+XDR for endpoint detection, log analysis, and threat response
• OpenClaw agent architecture: primary agent + 3 subagents (Wazuh Bridge, Parental Control, Billing & Subscriber)
• Cron jobs for alert polling, parental monitoring, device health, weekly reports, subscription checks
• AI-augmented analysis: automated threat triage with human escalation

Differentiator

Supplement Blue Team MSS with a 24x7 Agentic AI Team plus Human-in-the-Loop (HITL) for an enterprise-grade security monitoring.

The Problem

Singapore VAPT market is expensive (S$4,500+ for standard assessments) and slow (2–4 weeks). SMEs need CREST-quality assessments at a price point that makes security testing routine, not a luxury. The Cybersecurity Act 2024 requires CSRO licensure — raising the barrier but also creating a market for compliant providers.

What We're Building

Positions as "CREST-quality assessments, delivered faster, because AI handles the tedious parts while human experts focus on what matters."

• AI-assisted reconnaissance, enumeration, and vulnerability scanning
• Human experts (OSCP, CREST CRT certified) focus on exploitation and analysis
• Standardised reports: executive summary, risk matrix, remediation priority, re-test with revision tracking
• Productised remediation advice — consultant credits purchased separately
• Cyber Trust Mark Promoter Level 3+ compliance target by Dec 2026

In-House Credentials

CISSP, CCSP, AWS Security Specialty, Azure Security Engineer, PDPA Practitioner, MITRE ATT&CK, Purple Teaming, AWS AI Practitioner — compliance and cloud advisory already covered.