A slideshow in 9 parts. Use the left and right arrow keys, swipe, or the Next and Back buttons. Press Escape to close.
AEGIS Preview01/09
A project by Ahmed Kadhem Al Kadhem·SAIF 2026
AEGIS
A Saudi-made firewall that understands business rules.
→ Press the arrow key, swipe, or tap to start
01 · The problem
Some attacks look completely normal.
Firewalls stop hackers who look like hackers. But a request can look clean and still break the business’s rules.
These are called business-logic flaws.
Normal firewall
!Looks like an attackBlocked
Refund 900 SARAllowedBut it breaks the rules
ExampleSomeone asks for a 900 SAR refund on a 300 SAR order.
ExampleAn employee approves their own payment.
02 · The big idea
Meaning, not looks.
Same requestRefund900 SARPaid300 SAR
A normal firewall asks“How does this request look?”Looks clean, allowedThe refund goes through.
AEGIS asks“What does this request mean?”900>300BlockedReason shown: the refund is more than what was paid.
A still illustration with pre-written text.
03 · What AEGIS is made of
One part finds. One part blocks.
Find & proveAegisForgeLooks for business-logic flaws in an app. When it finds one, it proves it.
its proof becomes a rule
BlockAegisWallSits in front of the website and blocks requests that break the business’s rules.
04 · AegisForge
It doesn’t just report a flaw. It proves it.
It looks where a request can seem normal but still break the rules:
Refunds
Approvals
Payments
The evidence is saved as a sealed proof pack. Anyone can check it offline.
Evidence untouchedVALID
One byte changedBROKEN
If even one byte of the evidence is changed, the check says BROKEN instead of VALID. This was tested. Illustration only: each square stands for a piece of the evidence.
05 · AegisWall
It stands in front of the website.
It checks every request against the business’s rules. These rules are learned, not a fixed list of known attack patterns.
RequestAegisWallWebsiteResult
A normal 200 SAR refundAllowed
A 900 SAR refund on a 300 SAR orderBlockedA refund can’t be more than what was paid.
A different person approves the requestAllowed
Someone approves their own requestBlockedNobody approves their own request.
These four are tested examples.
06 · Step by step
From finding a flaw to blocking it.
Seven steps, with proof kept along the way.
AegisForge
The rule
A human
AegisWall
1FindAegisForge finds a business-logic flaw.
2ProveIt proves the flaw and seals the evidence in a proof pack.
3Suggest a ruleA rule is proposed to stop that flaw.
4Test it firstIt’s replayed against the attack and normal requests, to check it works and doesn’t hurt real customers.
5Human approvesA named person switches it on. Until then, it only watches.
6Block with a reasonAegisWall blocks the bad requests and explains why.
7Proof for every decisionEvery block or allow is saved as evidence.
07 · Why it matters
It catches what looks clean, and stays careful.
Nothing switches on by itselfA named person approves every new rule. Before that, it only watches.
A clear reason for every blockWhen it blocks a request, it says which rule was broken.
Proof that can’t be secretly editedEvery decision is saved as proof that can be checked later.
“Success”Fake success for attack botsOptional and off by default. Flagged bots get answers that aren’t real, so they waste their time.
And the shop’s own code doesn’t need to change.
AEGIS in one line
It checks what a request means, not how it looks.
Built by Ahmed Kadhem Al Kadhem for SAIF 2026. Made in Saudi Arabia.
