Building Mastermind: Why We're Giving Our Entire Company an AI That Never Forgets a Finding, a Conversation, or a Client

Part One of a Two-Part Series on Our AI Security Operations Platform

Every security consultancy has the same vulnerability: institutional knowledge lives in people's heads.

When a senior pentester leaves, nuanced attack paths they discovered months ago leave with them. A new analyst joins the team, and it takes them weeks to get up to speed on a client's environment, poring through past reports, contracts, and scoping documents just to understand what's already been tested and what was found.

The problem isn’t technical, it’s structural. Sales doesn't know what engineering discovered last week. Engineering doesn't know what commitments sales made yesterday. Project managers are stuck playing telephone between departments, trying to piece together a complete picture of where things stand with any given client.

We've watched these patterns play out across the industry for years. Reports get delivered, findings get remediated (hopefully), and the hard-won intelligence from each engagement quietly fades into a PDF sitting in a shared drive somewhere. Meanwhile, the next engagement starts from near-zero context, and the team next door has no idea it even happened.

We decided to redesign how institutional memory works.

The Problem With How Security Consultancies Manage Knowledge

Our team runs dozens of concurrent engagements across clients with vastly different environments, tech stacks, compliance requirements, and risk profiles. Over time, we've accumulated tens of gigabytes of pentest reports, vulnerability assessments, contracts, scoping documents, remediation tracking, and client correspondence.

That body of work represents an enormous amount of institutional intelligence: patterns in how certain industries get breached, common misconfigurations across specific technology stacks, remediation timelines that actually work versus ones that don't, and the kind of contextual understanding that separates a good consultancy from a great one.

The problem is that none of it is queryable. You can't ask a folder full of PDFs a question. You can't say "which of our clients are running outdated TLS configurations" or "what did we recommend for Client X's segmentation issues last quarter" and get an answer. That knowledge exists, but it's locked behind document formats and human memory.

And that's just the technical side. On the business side, the friction is even worse. A sales lead preparing for a renewal call has to track down three different engineers to understand where the engagement stands. An account manager trying to scope a follow-on project has to reconstruct a timeline from scattered Slack messages and half-remembered conversations. The information exists somewhere in the company, but getting to it requires interrupting the people who have it.

Traditional approaches like wikis, ticketing systems, and knowledge bases help with structure but fail at synthesis. They can store information, but they can't reason about it. And they certainly can't bridge the gap between what engineering knows and what sales needs.

	Traditional Approach	With Mastermind
Finding past engagement details	Search shared drives, ask colleagues, read old PDFs manually	Ask a natural language question, get a sourced answer in seconds
Prepping for a client renewal	Chase down engineers, piece together Slack threads, skim reports	Query full engagement history, findings, remediation status, and next steps in one conversation
Cross-referencing patterns across clients	Relies entirely on individual memory and experience	Instant retrieval across the entire document and conversation corpus
Onboarding a new team member	Weeks of shadowing and document review	Immediate access to the firm's full institutional knowledge
Cross-department visibility	Scheduled syncs, status meetings, email chains	Always-current, role-aware context available on demand

Enter Mastermind

We're building an internal AI operations layer called Mastermind. At its core, it's a cybersecurity-specialized AI assistant that has deep contextual awareness of every engagement we've ever run, every conversation our team has had with it, and every document we've produced. It runs entirely on infrastructure we control.

But Mastermind isn't just a tool for our security engineers. It's designed to serve every department in the company, because the knowledge that drives our business doesn't belong to any single team.

Department	Example Queries
Engineering	“What were the critical findings from Client X’s last external assessment?” “How does this SQLi finding relate to their PCI scope?” “We found a similar vulnerability on another client’s network last year. What remediation approach did we recommend, and did it hold up on the retest?”
Sales	“What has our engineering team been working on with Client X over the past quarter, and what are the natural next steps from a business development perspective?” “Which clients are coming up on contract renewals in the next 60 days?” “Client Y mentioned they’re concerned about cloud security. What relevant capabilities have we demonstrated with similar clients?”
Project Mgmt	“What’s the current status across all active engagements for Client Z?” “Are there findings from recent assessments that could inform the scoping for their upcoming retests?” “Summarize the last three months of activity with this client across all departments.”

These aren't hypothetical queries. These are the kinds of questions people across our company ask each other every day on Slack, in hallway conversations, and in meetings that could have been an email. The difference is that Mastermind has perfect recall across every document and conversation we've ever had with it, and it's available at 2 AM when nobody else is.

The Coordination Layer: Conversations as Context

Here's where Mastermind goes beyond a traditional knowledge base or document retrieval system.

Every conversation that a team member has with Mastermind becomes part of the agent's working context. When an engineer spends an hour working through a complex finding with Mastermind, asking follow-up questions and refining the analysis, that entire exchange is retained. When a sales lead later asks about the same client, Mastermind can draw on the substance of that engineering conversation to provide a complete, cross-functional picture.

This is the key insight that makes Mastermind more than just a search engine with a chat interface. It becomes the connective tissue between departments. Sales doesn't need to interrupt engineering to get a status update. Engineering doesn't need to write up summaries for the business team. The knowledge flows naturally through the system because every interaction enriches the shared context.

Think of it this way:

Mastermind is like giving every person in the company a colleague who has sat in on every meeting, read every report, and remembers every conversation, but who also understands the difference between what an engineer needs to hear and what a sales lead needs to hear.

Technically, this works through a combination of conversation memory and role-aware retrieval. Each interaction is stored with metadata about who initiated it, when it occurred, and what topics were covered. When a new query comes in, the system retrieves not only from the document corpus but also from the accumulated conversational context, weighted by relevance and recency. The retrieval layer understands that when a sales lead asks about a client, they need a business-oriented synthesis, while an engineer asking about the same client needs technical depth. The same underlying knowledge gets surfaced through different lenses depending on who's asking.

Why We're Running Everything Locally

This was non-negotiable from day one. We handle sensitive client data: pentest findings, network architectures, vulnerability details, contracts with NDAs. Sending any of that to a third-party API for inference is a risk we're not willing to take, regardless of what the provider's privacy policy says.

This constraint becomes even more critical when conversations themselves are part of the knowledge base. Internal discussions about client vulnerabilities, business strategy, and engagement planning are exactly the kind of information that should never leave your network. By running the entire stack on our own hardware, we ensure that every document, every query, and every conversation stays under our control.

So we built the entire stack to run on premises. The language model, the document processing pipeline, the vector database, the conversation memory store, the retrieval engine, the team-facing interface: all of it runs on hardware we own, in an environment we control. No client data ever leaves our network. No internal conversations are processed by external services.

This is not a convenience trade-off. It's a trust mandate. When a client hires us for a security assessment, they're trusting us with information about their most critical vulnerabilities. We take that trust seriously enough to invest in the infrastructure required to keep AI-assisted workflows entirely in house.

The Architecture: How It Actually Works

Mastermind is built on four layers.

Layer	Role
Knowledge	Ingests, chunks, tags, and embeds the full document corpus into a vector database with metadata filtering by client, date, type, and severity.
Conversation	Persists and indexes every team interaction. Threads are embedded into the same vector space as documents, enabling cross-departmental context retrieval.
Intelligence	A cybersecurity-specialized language model running on local GPU hardware, pre-trained on vulnerability databases, threat intel frameworks, and compliance standards.
Interface	Browser-based chat with per-client workspaces, cross-client views, and role-based access controls for department-appropriate visibility.

The Knowledge Layer ingests and indexes our entire document corpus: pentest reports, contracts, scoping documents, remediation guidance, and internal notes. Documents are broken into semantically meaningful chunks, tagged with metadata including client name, engagement date, document type, and finding severity. These chunks are then embedded into a high-performance vector database purpose-built for similarity search at scale.

This is where the nuance matters. Pentest reports aren't blog posts. You can't just naively split them into equal-sized text blocks and hope for the best. A finding's description, its proof of concept, and its remediation guidance need to stay contextually linked. We invested significant effort into a chunking strategy that respects the structure of security deliverables, so retrieval actually returns useful context rather than fragments.

The Conversation Layer persists and indexes every interaction team members have with Mastermind. Each conversation is stored as a structured thread with metadata including the team member's role, department, the clients and topics discussed, and timestamps. These threads are embedded into the same vector space as the document corpus, which means that conversational context and document context are both available during retrieval. When an engineer works through a complex analysis with Mastermind and a sales lead asks a related question the next day, the system can connect those dots automatically.

The Intelligence Layer is a cybersecurity-specialized language model running locally on dedicated GPU hardware. We deliberately chose a model that was purpose-built for security work, pre-trained on vulnerability databases, threat intelligence frameworks, compliance standards, and attack methodology documentation. It understands CWEs, CVSS scoring, MITRE ATT&CK mappings, and remediation best practices natively, without needing them explained in every prompt.

This matters more than people realize. A general-purpose language model can answer security questions, but it lacks the domain density that a specialized model brings. When our analyst asks about the relationship between a finding and a compliance framework, Mastermind doesn't just pattern-match on keywords. It understands the security context.

The Interface Layer gives our team a clean, workspace-based chat interface they can access through a browser. Each client gets an isolated workspace, so queries are scoped to the right document set. But team members also have access to a cross-client view for broader questions like "which of our clients have we flagged for outdated dependency management" or "what patterns are we seeing across our healthcare clients this quarter." Role-based access controls ensure that sensitive engagement details are only visible to authorized team members while still allowing the cross-departmental knowledge sharing that makes Mastermind valuable.

What Changes When Your Entire Company Has Perfect Recall

The most immediate impact is speed. An analyst who previously spent 30 minutes digging through past reports to understand a client's history now gets that context in seconds. A sales lead who used to chase down three engineers for a status update before a client call now asks Mastermind and gets a comprehensive summary in moments.

30 min → 30 sec Client history retrieval

3 people → 1 query Cross-department status updates

Day 1 access New hire onboarding to full institutional knowledge

The real impact is qualitative.

Engineers start seeing patterns that would otherwise take years of individual experience to notice. They catch recurring misconfigurations across clients in the same industry. They reference successful remediation strategies from past engagements instead of writing generic guidance. They produce reports that are contextually richer because they're building on everything the firm has ever learned, not just what one analyst remembers.

Sales and account management become dramatically more informed. Instead of walking into a renewal conversation with a surface-level understanding of the engagement history, they have a complete picture: what was tested, what was found, what was fixed, what was recommended, and what conversations engineering has already had about next steps. They can speak to the client's security posture with a depth that most consultancies reserve for the technical team.

And perhaps most importantly, the walls between departments start to dissolve. When everyone in the company has access to the same institutional memory, filtered through their own professional lens, the entire organization moves faster and with better alignment. Engineering decisions inform sales strategy. Sales conversations surface new engagement opportunities for engineering. The feedback loop tightens because the information no longer has to pass through human bottlenecks to move between teams.

Mastermind doesn't replace anyone's expertise. It amplifies it. It gives every member of the team, from the most junior analyst to the most senior account executive, access to the full depth of the firm's collective intelligence.

Automated Knowledge Ingestion

A knowledge platform is only as good as the data feeding it. We're building an automated pipeline that syncs documents from our project management platform on a continuous basis. When a new report is finalized, a new contract is signed, or a remediation update comes in, the relevant documents are automatically chunked, embedded, and indexed into the appropriate client workspace.

Conversations are indexed in near real time. As team members interact with Mastermind throughout the day, each exchange is processed, embedded, and made available for future retrieval. This means that a conversation an engineer has at 9 AM can inform a sales lead's query at 2 PM the same day.

This eliminates the "knowledge decay" problem that plagues most internal tools. There's no manual upload step for analysts to forget. No weekly syncs that leave the system perpetually behind. The system stays current because it's wired directly into the workflows the team already uses.

Where We're Headed

Mastermind is the foundation. Once the knowledge and conversation layers are mature and the team is relying on it daily, the natural next step is connecting it to our operational tooling: feeding in live scan results, correlating them against historical findings, and eventually enabling it to draft sections of reports based on what it knows about the client's environment and our firm's writing standards.

On the business side, we see Mastermind evolving into an active coordination layer that can proactively surface insights rather than waiting to be asked. Imagine the system notifying sales when an engineering conversation reveals a natural upsell opportunity, or alerting project management when a remediation timeline is slipping based on patterns it's observed across similar engagements.

We're also building a companion system (more on that in a future post) that focuses on the offensive side: automated validation and verification of vulnerability findings. Together, these systems represent our vision for what a modern, AI-augmented security consultancy looks like. One where the technology handles the information retrieval, pattern recognition, and cross-functional coordination, while the humans focus on the judgment, creativity, and client relationships that actually drive value.

The Bigger Picture

The security consulting industry is at an inflection point. The firms that figure out how to operationalize AI, not as a marketing checkbox but as genuine force multiplication for their entire organization, are going to pull ahead. Not because AI replaces the work, but because it eliminates the friction that slows the work down and the silos that keep teams from operating as one.

We've spent the last several months researching, prototyping, and architecting Mastermind because we believe this is where the industry is going. We intend to build that future for ourselves.

Mastermind is currently in active development, with deployment planned for our production environment in the coming weeks. We'll share more as the system matures and our team starts putting it through its paces on real engagements.

This is part one of a two-part series on our AI security operations platform. Part two will cover Sentinel, our autonomous vulnerability validation system. Stay tuned.