# Nussknacker Threat Intelligence

> Real-time fraud detection, abuse prevention and AI agent security built on Nussknacker, the open-source low-code decision engine for streaming and request-response.
> It turns event streams into decisions in real time: it scores every login, payment and chat message, lets the risk team own the policy, and blocks, challenges or sends to triage.

## What it does

- Computes features over time windows from event streams, per user, device and card.
- Scores them with your own models (MLflow, Databricks or any endpoint with a contract), with a challenger in shadow next to the champion.
- Applies a policy as a decision table that risk analysts edit, test on real records and deploy as a new version.
- Acts in real time: block, challenge, triage or allow, with the rule, the signals and the model versions behind every decision.
- Tracks AI assistants and agents per user over time: jailbreak attempts, prompt injection, data harvesting through tools and account farms, enforced at the gateway outside the model.

## How it runs

- Streaming on Apache Flink for long windows, large state and heavy traffic.
- A lightweight engine for the same scenarios on a small footprint, without a Flink cluster.
- Request-response, as an inline decision API.
- As a managed cloud service, in your cloud account (BYOC) or self-hosted, including air-gapped.

## Governance

- Role-based access control for users, groups and API tokens.
- Single sign-on with OpenID Connect or OAuth2.
- Every policy and model change is a version with an author and a comment, easy to compare and roll back.
- Human review queues and appeals for decisions with real impact.
- Open-source core: no lock-in on the decision logic.

## Beyond fraud

The same engine detects threats to ships and critical infrastructure from live AIS vessel positions: going dark, loitering, anchor dragging over pipelines and proximity to cables and offshore infrastructure.
Video: [Real-Time AIS Vessel Monitoring, No Flink Code](https://www.youtube.com/watch?v=qZIKr-cu2iU)

## Page sections

- [Explainable decisions](/#decisions)
- [Coverage: fraud, abuse and AI security](/#threats)
- [Product tour](/#tour)
- [Incident replay: a BIN attack at checkout](/#incident)
- [How it works](/#how)
- [Security for AI agents](/#ai-agents)
- [For engineers](/#developers)
- [Integrations](/#integrations)
- [Deployment and governance](/#deploy)
- [FAQ](/#faq)

## More

- [Nussknacker](https://nussknacker.io/)
- [Nussknacker documentation](https://nussknacker.io/documentation/)