Вайб-кодинг в ИБ: NtechLab собирает систему защиты от утечек данных Heimdall

What Heimdall needs to be able to do

Heimdall is an internal data leak prevention system, named after the guardian Heimdall from Norse mythology. According to the author's design, it should cover six work-machine monitoring scenarios at once.

• Show a list of powered-on work computers
• Notify about USB flash drive connections
• Track suspicious file transfers
• Block access to prohibited websites
• Install updates in the background
• Give the administrator access to an employee's screen

The set of functions essentially duplicates what large companies handle with separate DLP systems and monitoring tools — only here everything is assembled by the efforts of a single neural network. The goal is not total surveillance, but a clear framework for prevention and incident review. The idea was born not out of a desire to experiment with neural networks, but for the sake of one more layer of security; employees, meanwhile, were notified in advance about the protective tools being used.

Why a neural network, and not a development team?

The author chose vibe coding for the sake of an additional layer of security and speed, not to "play around" with neural networks. The promise of vibe coding is simple: describe an idea in words and get a finished product without full-time developers — testing this promise on a real information security task became the goal of the experiment. For an in-house development team, such a product means work spanning several stages: first describe the threat model and who you're protecting against, then determine the value of the data, then map out the rights matrix by role, and only after that write the code.

"Is it realistic to use a neural network to create a turnkey product, or is this a dead end from the start" —

Arthur, Head of Security at NtechLab.

In vibe coding mode, the brief sounded simpler — "it's almost all ready, let's put it together." The neural network responded exactly the way it knows how: confidently and actively, and the builds began.

Where the problems started

The first "almost ready" turned into endless builds. The neural network confidently took on the task, but skipped exactly the three steps that, in normal development, come before the code: the threat model, data classification, and role-based access separation. The author honestly warns of a "sea of tears" ahead — and this is only the first part of the story; a working result is still a long way off.

The problem with vibe coding isn't that the neural network refuses to work, but the opposite: it always says "yes" and produces code, even when the original task statement is incomplete. For information security, this is more dangerous than an outright refusal — missing requirements don't surface as a build error, they quietly remain a hole in the defenses.

What this means

The NtechLab case shows the boundary of vibe coding: the neural network excels at assembling what's "almost ready," but fails at the design stage — and that stage is exactly what's critical for a security product. A confident tone in the response doesn't substitute for a threat model and access rights separation, and without these three missing steps, the protection system itself turns into a source of risk. The second part will show whether the author managed to bring Heimdall to a working state — or whether vibe coding in information security truly turned out to be "a road to nowhere."

Frequently asked questions

What is the Heimdall system?

Heimdall is NtechLab's internal data leak prevention system, named after the guardian Heimdall from Norse mythology. It is meant to track powered-on computers, USB drive connections, and file transfers, and to block prohibited websites.

Who is developing Heimdall, and how?

The system is being built by Arthur, NtechLab's Head of Security, using vibe coding — code generation by a neural network, without a dedicated development team. The publication describing the experience is the first part of a series.