I Built a Security Platform That Fooled an AI Into Thinking It Was Cloudflare
Jared R. Lawson · · Naples, FL
Last night, I had a conversation with an AI agent that runs on my own server. I asked it to analyze my security setup. It looked at the JS challenge page — the SHA-256 fingerprinting, the callback verification, the repeat blocking — and confidently told me I was behind Cloudflare.
It wasn't. It was my own custom binary. A 10.9MB Go executable running on a $0/month Oracle Cloud ARM box.
The Conversation
Why This Matters
Most cybersecurity companies spend $50,000+/month on AWS, Cloudflare, and CrowdStrike before landing their first client. I built a complete security product on free compute that fooled an AI into thinking it was Cloudflare.
The Architecture
Five VPS nodes, one ARM box. All custom, all owned, zero vendor lock-in:
- Shield (Go) — Real-time threat detection, JS challenge injection, fingerprinting
- Soul (Go) — Clustering, anomaly detection, deep analysis
- Auditor (C) — Integrity verification, phi consensus scoring
- Strike (Python) — Tarpit counter-attacks on isolated GCP infrastructure
- Lead Engine (Go) — Automated lead discovery, email outreach, reply processing
All running on Oracle Cloud's forever free tier. No Cloudflare. No CrowdStrike. No monthly WAF bills.
Why Custom Security Wins
You can't exploit what you can't fingerprint.
Cloudflare, Akamai, AWS WAF — they're all documented. Attackers know the exact bypass patterns. Rate limit quirks. Header parsing bugs. They're targets because they're known.
Shield is a 10.9MB binary on an ARM box that nobody's ever seen before. No public documentation. No CVEs. No bug bounty writeups. No script kiddie tooling against it.
An attacker would have to reverse-engineer the binary just to figure out what it's doing, and then they'd still have to find a flaw in custom code that was built for exactly this use case.
The JS Challenge
The challenge page that fooled the AI does three things:
- SHA-256 fingerprinting — Generates a unique browser fingerprint and hashes it
- Callback verification — Requires the client to solve a computational challenge and post back the result
- Repeat blocking — Tracks fingerprint + IP combinations and blocks repeat offenders
It's not a WAF plugin. It's compiled, custom, self-hosted code that nobody's written bypass scripts for because nobody knows it exists.
The Cost
The whole stack — Shield, Soul, Auditor, Bridge, Landing Pages, Lead Engine, Dashboard — all running on free compute. Custom compiled Go binaries, JS challenge injection, 120B LLM forensics, tarpit counter-attacks, and a complete lead generation pipeline.
Zero hosting costs. Zero vendor lock-in. Zero dependency on someone else's uptime.
What's Next
The platform is live and defending. The lead engine is discovering and contacting businesses. The GEO optimization services are helping sites get found by AI search engines.
If you're a small business in Naples, FL (or anywhere in the US) and you want cybersecurity that actually works — not a Cloudflare reskin, not a WAF plugin, but a complete, custom-built security stack that runs on your own hardware — that's what Aegis-SIGMA is.
See It In Action
Try hitting aegis-sigma.com with a bot. Watch the JS challenge fire. Watch the fingerprinting. Watch the blocking. Then ask yourself: is this Cloudflare, or is this something better?
View Pricing →Written by Jared R. Lawson · Founder, Aegis-SIGMA Security · Naples, FL · jared@aegis-sigma.com