Vibe Coding for Infosec: NtechLab Builds Its Heimdall Data Leak Protection System

The security director at NtechLab set out to build Heimdall, an in-house data leak protection system, by vibe coding: a neural network does the work, with no dedicated development team. He described his experience in a blog post on Habr; this is the first part.

What Heimdall should be able to do

Heimdall is an internal data loss prevention system, named after the guardian Heimdall from Norse mythology. By the author's design, it should cover six scenarios for monitoring work machines.

• Show a list of work computers that are switched on
• Notify about USB drive connections
• Track suspicious file uploads
• Block access to prohibited websites
• Install updates in the background
• Give an administrator access to an employee's screen

The feature set essentially repeats what large companies cover with separate DLP systems and monitoring tools, except here it is all built by a single neural network. The goal is not total surveillance but a clear loop for preventing and investigating incidents. The idea did not come from a wish to experiment with neural networks, but from the need for one more security loop; employees, for their part, have been notified in advance about the protection tools in use.

Why a neural network instead of a development team?

The author chose vibe coding for the sake of an additional security loop and for speed, not to "play around" with neural networks. The promise of vibe coding is simple: describe an idea in words and get a finished product without in-house developers. Testing that promise on a real infosec task became the goal of the experiment. For an in-house development team, such a product means several stages of work: first describe the threat model and who you are defending against, then determine the value of the data, then lay out a role-based permissions matrix, and only after that write code.

"Is it actually possible to use a neural network to create a turnkey product, or is it a road to nowhere from the start?" —

Artur, security director at NtechLab.

In vibe coding mode, the brief sounded simpler: "it's almost all done there, let's build it." The neural network answered exactly the way it knows how, confidently and energetically, and the builds began.

Where the problems began

The first "almost done" turned into endless builds. The neural network confidently took on the task but skipped precisely the three steps that come before code in normal development: the threat model, data classification, and role-based permission separation. The author honestly warns of a "sea of tears," and this is only the first part of the story; a working result is still far off.

The problem with vibe coding is not that the neural network refuses to work, but the opposite: it always says "yes" and produces code even when the original task statement is incomplete. For infosec, this is more dangerous than an outright refusal: missing requirements do not surface as a build error but quietly remain as a hole in the defenses.

What this means

The NtechLab case shows the limit of vibe coding: a neural network is great at assembling what is "almost done" but fails at the design stage, which is exactly what is critical for an infosec product. A confident tone does not replace a threat model and permission separation, and without those three skipped steps the protection system itself becomes a source of risk. The second part will show whether the author managed to bring Heimdall to a working state, or whether vibe coding in infosec really turned out to be a "road to nowhere."

Frequently asked questions

What is the Heimdall system?

Heimdall is NtechLab's internal data leak protection system, named after the guardian Heimdall from Norse mythology. It is supposed to track which computers are switched on, USB drive connections, and file uploads, and to block prohibited websites.

Who is developing Heimdall, and how?

The system is being built by NtechLab security director Artur using vibe coding, meaning code generated by a neural network, with no dedicated development team. The post describing the experience is the first part of a series.