Securing a University's Research Infrastructure
A large public university runs a sprawling IT environment: student portals, research lab servers, faculty intranets, IoT devices in smart buildings, and shared HPC (High-Performance Computing) clusters. The central IT security team of two people is responsible for securing all of it. They have no budget for commercial penetration testing tools and limited time for manual assessments.
Run on Vedha · Security & Assurance
The challenge
The university's network spans hundreds of subnets with thousands of hosts many managed by individual departments with no centralized oversight.
Research servers often run outdated software (old Linux kernels, unpatched Apache/Tomcat instances) because researchers prioritize experiment continuity over patching.
A recent ransomware incident at a peer institution has prompted the university's CIO to demand an immediate security posture assessment.
How Vedha solves it
Broad Network Reconnaissance
The IT team configures a VEDHA Flow with the goal: "Perform network-level reconnaissance and vulnerability assessment across the 10.0.0.0/8 research subnet. Identify exposed services, outdated software, default credentials, and critical misconfigurations."
Docker-Isolated Scanning
VEDHA spawns a sandbox container pre-loaded with 'nmap', 'nikto', and 'hydra'. The Primary Agent systematically scans subnets, discovers live hosts, fingerprints services, and tests for known CVEs all within the isolated container, preventing any accidental disruption to research workloads.
Context Chain Summarization
Scanning hundreds of hosts generates enormous amounts of terminal output. VEDHA's Summarizer Agent and the 'csum' library compress thousands of lines of 'nmap' output into structured Q&A summaries, keeping the agent's context window focused on actionable findings rather than drowning in raw data.
Semantic Memory for Cross-Host Correlation
As findings accumulate, the pgvector semantic memory store allows VEDHA to correlate patterns across hosts. When the agent notices that 15 different research servers all run the same vulnerable version of Apache Tomcat 8.5.31, it flags this as a systemic issue rather than 15 isolated findings.
Resilient Web Search
When VEDHA encounters an unfamiliar CVE, the Web Search Orchestrator queries multiple engines (Google, DuckDuckGo, Sploitus) to retrieve exploit details and remediation guidance, falling back automatically if any single source is unavailable.
The outcome
- IT team receives a comprehensive asset inventory
- 0+ hostsIT team receives a comprehensive asset inventory
- found running services with known critical CVEs (CVSS ≥ 9.0
- 0 hostsfound running services with known critical CVEs (CVSS ≥ 9.0
The IT team receives a comprehensive asset inventory and vulnerability report covering 1,200+ hosts in under 72 hours-a task that would have taken months manually.
47 hosts are found running services with known critical CVEs (CVSS ≥ 9.0), including 12 instances of a remote code execution vulnerability in an unpatched Tomcat installation.
The report enables the CIO to present concrete risk metrics to the university board and prioritize a targeted patching campaign.
Representative scenario: a modelled industry situation showing how this accelerator applies. Figures are projections, not a named client result.
Capabilities used
Every accelerator is assembled from the same capability layer, so a workflow you adopt here shares its foundation with the rest of the portfolio.
More from Vedha
Safety & Security
Continuous Security for a Fast-Moving SaaS Startup
A Series-B SaaS startup ships product updates multiple times per week. Their engineering team of 40 developers deploys microservices across AWS ECS, but they have only one part-time security engineer. Manual penetration tests are performed once a quarter by an external vendor, costing $15,000-$25,000 per engagement, and the reports arrive weeks after the code has already changed.
Safety & Security
Pre-Compliance Penetration Testing for a Healthcare Platform
A digital health company building an electronic health records (EHR) platform must satisfy HIPAA security requirements before launching. Their compliance officer needs evidence of penetration testing to include in the security risk assessment. The company's infrastructure includes a React frontend, a Node.js/Express API, a PostgreSQL database, and an S3 bucket storing patient documents.
Safety & Security
Red Team Simulation for a Financial Institution
A mid-size bank with 2,000 employees conducts annual red team exercises as part of its cybersecurity maturity program. The internal red team consists of three senior security engineers who manually simulate adversary tactics across the bank's external-facing infrastructure: internet banking portals, mobile API gateways, and partner integration endpoints. Each exercise takes 4-6 weeks.
Bring us the version of this that you actually have.
Every engagement is fixed-scope and outcome-guaranteed. The scoping conversation starts with your systems, not with a template.