DEWLine: Four Security Systems, One Question No Single Tool Can Answer

Most nonprofit IT people are busy or buried. Their security signal lives in separate consoles: Google Workspace for logins, Cloudflare for the website's front door, WordPress for admin activity, an endpoint agent for laptops. None of them talk to each other.

That's a problem, because an attacker who moves from the website to email to a laptop looks harmless in each console on its own. Every tool sees a small, ordinary-looking piece. Nobody sees the path.

DEWLine is built to see the path. It pulls every source into one place and asks one question no single tool can: is this the same threat, seen from four angles?

How it works

1. Ingest. Connectors pull each source into BigQuery, raw and unchanged.
2. Normalize. Every event gets mapped to one common shape: who, what, where and what happened.
3. Enrich. Every IP address gets tagged with a country and a network type, so a home connection looks different from a VPN or a data center.
4. Detect. Fixed SQL rules flag known risks. Same input, same answer, every time.
5. Reason. A read-only Gemini layer turns plain-English questions into answers that cite the evidence behind them.

The rule that matters most: layers never blur

Raw evidence is never overwritten, and every finding links back to the record it came from. The AI only queries approved views, never raw or restricted data. It can read and reason. It cannot change an account, block an IP address or take any action. Humans keep every decision.

That's a design choice, not a limitation. Security tools that act on their own create a second problem: nobody can explain what they did or why.

What it found on real data

The first run used live data from a working community organization. Three findings stood out.

• A VPN-login cluster on critical accounts. Several staff log in through commercial VPNs, including an administrator account signing in through a VPN exit in Panama. That's not proof of compromise. It's a prompt to ask, "Is this expected?"
• Two systems agreeing on one person. The endpoint agent flagged one staff account for identity compromise three times. Google Workspace separately showed a successful login for the same account from Mexico. Two unrelated tools landing on one account is signal, not noise. The recommended action was a human conversation.
• Clean where it counts. No IP address that Cloudflare blocked ever succeeded at a Google login, and no attacker WordPress blocked reached the identity layer. The cross-system check ran and found no breach path. That's a result worth having.

Why convergence is the whole point

One noisy tool cries wolf. Two independent tools agreeing is the strongest signal in security. DEWLine's convergence rule automatically surfaces anyone flagged by two or more systems. On the first run, that turned roughly 750,000 events into a list of four people worth a closer look.

Where it stands

It's a working prototype: four live sources, the full pipeline, seven detection rules tuned on real data, a working AI analyst and 46 automated tests passing. When its data goes stale, the analyst lowers its own confidence and says so instead of guessing.

Next up: scheduled data pulls, tighter permissions, two more sources (outside threat intelligence and email quarantine), reading message content for intent, and a case-management screen.