This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Every security team has ghosts.

An audit finding that has been open for weeks. Evidence that nobody can locate. A vendor review waiting for a response. A security exception without a confirmed owner.

They rarely make a dramatic entrance. They sit quietly in spreadsheets, trackers, and follow-up emails until somebody asks the question nobody wants to hear:

"Why is this still open?"

Working around the Business Information Security Office (BISO) inspired me to explore that problem through a Halloween-themed AI project.

Meet The Ghost in the BISO — a local-first AI companion designed to help security teams investigate forgotten risks before they return as tomorrow's audit findings.

What I Built

The Ghost in the BISO turns a fictional security risk register into an interactive investigation.

It has four main capabilities:

Ghost Radar: Highlights open findings, aging items, high-severity risks, and evidence gaps.

Evidence Séance: Generates an actionable checklist for investigating missing audit evidence.

Ask the Ghost: Lets users question their risk register in natural language.

BISO Briefing: Drafts a leadership-ready summary of key concerns and recommended follow-ups.

The experience is deliberately spooky, but the underlying goal is practical: help security professionals turn scattered findings into clear, actionable conversations.

Demo

Code

V-V-K / Ghost-in-the-BISO

A local-first, open-weight AI copilot that resurrects forgotten cybersecurity risks and helps BISO teams prepare for audits.

👻 The Ghost in the BISO

An offline-first, open-weight AI companion for security risk, audit readiness, and remediation.

The past leaves evidence. The future inherits risk.

The Ghost in the BISO turns a fictional BISO risk register into an interactive security governance demo. It highlights aging findings, missing owners, evidence gaps, and high-severity open items; then uses a locally running model to explain the data and draft a leadership briefing.

Why this exists

Security teams often have risk registers and audit trackers spread across tools. This prototype explores how local AI can help a BISO interpret that information without sending sensitive records to a hosted AI API.

Features

• Ghost Radar: transparent Python-based metrics and a findings dashboard.
• Evidence Séance: identify missing evidence and generate a request checklist.
• Ask the Ghost: question the fictional register in natural language.
• BISO Briefing: generate and download a Markdown leadership summary.
• Local inference: uses Ollama's…

View on GitHub

The project includes a fictional sample dataset so anyone can reproduce the demo without access to real enterprise security information.

How I Built It

The application uses Python, Streamlit, Ollama, and the Qwen3 open-weight model.

Python and Pandas calculate the dashboard metrics. Streamlit provides the interactive interface. Ollama runs the model locally, allowing the application to generate explanations, evidence checklists, and leadership summaries without depending on a hosted AI inference API.

I deliberately separated deterministic calculations from AI-generated explanations. A language model can help interpret a finding, but it should not be the source of truth for how many risks are open.

The prototype uses synthetic records covering application security, vendor risk, privileged access, vulnerability management, audit evidence, and security awareness.

Why Does Open Innovation Matter?

Security data is not ordinary chatbot input.

Risk registers and audit evidence can reveal sensitive details about an organization's technology, weaknesses, and remediation priorities. Sending such information to an external AI service may introduce privacy, contractual, or governance concerns.

A local-first approach gives this experiment a different starting point.

Privacy: The local inference path can keep the prompts and test records on the machine rather than sending them to a hosted AI API.

Offline capability: Once the model and dependencies are installed, the application can run without an internet connection.

Freedom to experiment: A locally served model can be replaced with another compatible model, making it easier to compare response quality, speed, and resource requirements.

Transparency: The code is inspectable, the sample data is reproducible, and the risk metrics are calculated by explicit Python rules.

Open-weight AI does not automatically guarantee accuracy, security, or unrestricted licensing. Those still require testing and careful review. But it gives builders more control over where inference happens and how the application is designed.

The Spirit of It

The ghost is a metaphor for a problem familiar to security teams: unresolved risk never truly disappears just because it has stopped getting attention.

I wanted to build something that makes that invisible work visible, with a little Halloween atmosphere along the way.

The objective isn't to let AI make security decisions. It's to help a human ask better questions, identify missing information, and decide what deserves attention next.

Because in cybersecurity, the scariest ghost isn't the one in the machine. It's the risk everyone assumed was already dead.

Prize Categories

Overall Hacktoberfest Open-Source AI Challenge entry.