# Cyberpolycrisis

Turn connected threats into practical SME decisions.

AI Builder, Devekko.dev. Four-week AI builder sprint, October–November 2026. In progress.

Snapshot: October 29, 2026. Research resource & chat live.

Demo: https://cyberpolycrisis.com

A research and chat resource that helps small and midsize businesses understand how cyber threats and operational dependencies connect.

## Product intent

A small business can face several connected risks at once: a compromised account, a dependent supplier, an outage, and a team that is unsure which action matters first. Cyberpolycrisis turns research about those connections into a resource an owner or manager can explore.

The product combines reading, a readiness questionnaire, and source-linked conversation. Its purpose is to help an SME form a practical next question and choose an action to discuss with the people responsible for security.

## What the demo shows

The public resource includes a research report, topic articles, a network view of connected risks, a guided questionnaire, action guidance, and AI chat. The questionnaire scores self-reported practices. Readers can choose whether to include that assessment context in a conversation.

The chat uses a curated research corpus with a stated cutoff. It is not a live threat feed. Questionnaire scores are guidance about reported controls, not breach probabilities or a security certification. Research preparation can be automated while publication remains curated.

## Product specification

**Primary users:** SME owners, operations managers, and technology leads who need an understandable starting point for security planning.

**Core workflow:** explore a threat or dependency, answer a bounded set of readiness questions, inspect the suggested actions, and ask follow-up questions with access to the supporting sources.

The next release specification calls for:

- Dated sources and evidence labels that separate documented incidents, analysis, and scenarios.
- A transparent mapping between questionnaire answers and suggested actions.
- Retrieval of relevant published passages before an answer is generated.
- A clear response when the available research cannot support an answer.
- Explicit consent before assessment context is added to chat, with data handling explained at the point of use.

Acceptance means the advice can be traced to an applicable source, a stale claim is recognisable, and the interface does not turn a self-assessment into a promise of protection. Production security decisions still require the responsible team's review.

## Technology

The implementation uses a Cloudflare Worker with a static HTML, CSS, and JavaScript interface. Workers AI generates responses using retrieved material from a bundled search index. The current retrieval implementation is lexical: it matches against the published corpus rather than relying on a live browsing agent.

Turnstile validation and server-side quota controls help protect the public chat. The research index is built from published source material; a content update needs an index rebuild before it becomes available to answers.

Codex and Claude are part of the sprint's builder toolkit. The wider Pydantic AI, Prefect, Nemotron, and Brave API stack is relevant to future research preparation experiments. It is distinct from the currently documented chat runtime.

## Research and development

The research agenda is to make the connection between evidence and action inspectable:

1. Build a reviewed question set around account compromise, supplier dependency, recovery, and operational disruption.
2. Check whether each answer cites a source that actually supports its recommendation.
3. Test how the assistant responds to missing evidence, outdated material, and conflicting sources.
4. Review action lists with SME operators for clarity, effort, and ownership.
5. Evaluate a research-refresh workflow that proposes changes for editorial approval and records the new corpus version.

This is a research and guidance product. It does not scan a visitor's private network or remediate their systems.

## Business measures to test

Product measures include questionnaire completion, usefulness of the proposed next action, and return visits to an action plan. Quality measures include supported-answer rate, citation accuracy, and correct handling of questions outside the corpus. Operating measures include research-review time, cost per useful answer, and time to publish a verified correction.

These measures are an evaluation plan. They do not establish reduced breach losses or a quantified security outcome.

## Sources and next release

The public experience was reviewed on October 29, 2026: [Cyberpolycrisis](https://cyberpolycrisis.com). Technical details were checked against the project's product and implementation notes. No live questionnaire submission or chat interaction was performed for this write-up.

The next release decision is whether evidence coverage and explanation quality are sufficient to support a repeatable SME planning workflow.