Controlled security simulation
Engarde
A full-stack cyber range for authorized simulation of distributed network attack scenarios, with real-time orchestration, monitoring, telemetry, analytics, and assessment workflows.
- Role
- Founding Software Engineer
- Context
- From July 2024 to October 2025, I contributed to the architecture and product development of Engarde as an early engineering team member.
- Current status
- The professional contribution concluded in October 2025. Public material focuses on defensive product engineering and omits abuse-enabling operational detail.
Challenge
Controlled DDoS and distributed network simulation requires more than generating traffic. Operators need a bounded product workflow to define an authorized exercise, coordinate execution, monitor state, collect telemetry, and produce an assessment.
Architecture
Boundaries before implementation detail.
The system is organized around explicit responsibility, durable state, and observable handoffs.
Exercise definition
The product workflow captures an authorized simulation objective and the controlled environment in which it runs.
Orchestration
Backend services coordinate distributed scenario execution and expose real-time state to the operator interface.
Controlled execution
Simulation activity remains bounded to the approved defensive exercise and environment.
Telemetry pipeline
Monitoring and collection workflows turn execution events into evidence for analysis.
Analytics + reporting
Assessment interfaces organize telemetry into reviewable outcomes for security testing.
Key decisions
Decisions that shape the product.
Each choice defines a boundary the system can explain, test, and evolve.
Build a product, not an operator script
A full-stack workflow makes authorization, orchestration, monitoring, and assessment visible parts of the exercise lifecycle.
Telemetry is a first-class output
Simulation value comes from observable evidence and reporting, not simply from initiating a distributed scenario.
Real-time operator state
Interfaces and backend services were designed together so orchestration progress and monitoring information remain usable during an exercise.
Product boundaries carry safety intent
Authorized simulation and controlled scope are presented as non-negotiable product constraints rather than optional usage guidance.
Security considerations
Security is part of the system model.
Controls sit at data, identity, execution, evidence, and disclosure boundaries.
Authorized simulation only
Engarde is presented exclusively as a defensive testing product for environments where explicit authorization exists.
Controlled scope
The public design language keeps exercise definition and environment boundaries attached to orchestration intent.
No abuse instructions
This case study excludes traffic-generation procedures, exploit steps, target-selection guidance, and sensitive configuration.
Assessment over disruption
Monitoring, telemetry, analytics, and reporting frame the product around learning and defensive evaluation.
Result / current status
The project delivered a full-stack cyber range with real-time orchestration, monitoring, telemetry collection, analytics, and reporting capabilities for controlled security simulation and assessment.
Current limitations
- The exact application stack, deployment topology, public product status, repository, and live URL are not confirmed by the supplied sources.
- Operational simulation mechanics and environment controls are intentionally not published.
- No quantitative scale, performance, or adoption claims are included.
Lessons
What carries forward.
- Defensive simulation products need authorization and scope to be visible in the product model.
- Real-time orchestration is only useful when telemetry and reporting make the exercise reviewable.
- Security-product engineering must balance operator control with safe disclosure boundaries.