Kaaval

Project: Kaaval

Author's Self-Reported Purpose: An AI-powered email header analyzer built for cybersecurity professionals to detect phishing, validate SPF/DKIM/DMARC, extract IOCs, and generate SOC investigation reports.

Key Claim: The tool automates email security analysis using local LLMs (Gemma 3) and FastAPI, reducing analyst time.

What Changed: The author states they built this as a personal project for a cybersecurity hackathon, integrating AI into email header parsing and threat detection.

Single Most Important Open Question: Is there any evidence of real-world usage or integration with existing security tools?

This is a self-reported, unverified account of a single-person cybersecurity tool project submitted to a hackathon. No revenue, customers, traction, or product-market fit data are available beyond the author’s own description.

The description states that Kaaval is an AI-powered email header analyzer. It uses:

• Python
• FastAPI
• Ollama
• Gemma 3 (4B parameter model)
• ChatGPT for development assistance

It claims to:

• Analyze email headers
• Validate SPF/DKIM/DMARC
• Extract IOCs (Indicators of Compromise)
• Detect phishing indicators
• Generate AI-assisted SOC investigation reports

Inference: The tool appears to be a proof-of-concept or prototype built for a hackathon, not a commercial product. It is not evidenced to be in production or used by others.

The author states:

• They were "fascinated with email analysis" and wanted to automate phishing detection.
• The tool helps security analysts reduce time spent on investigation.
• It integrates local LLMs into cybersecurity workflows.

Claim: Kaaval is positioned as a cybersecurity automation tool for SOC analysts, using AI to improve email threat detection and reporting.

Inference: This is a self-positioning statement. No evidence of market validation, customer feedback or product positioning beyond the author’s own description.

The description states:

• It helps security analysts
• Specifically those working in SOC (Security Operations Center) environments
• Aims to reduce analyst time on email analysis

Inference: The target customer is likely a cybersecurity professional or SOC team member, but there is no evidence of actual customers, use cases, or feedback from such users.

The description does not mention:

• Any pricing model
• Revenue streams
• Monetization strategy
• Subscription plans or licensing

Not evidenced: No indication of how the tool would be sold or monetized.

The author states:

• Built with Python, FastAPI, Ollama, Gemma 3
• Used ChatGPT as a programming assistant
• Integrated local LLMs for email analysis
• Handles varied email header formats
• Parses headers and extracts IOCs

Inference: The tool is technically feasible and uses modern stack components. However, it is not evidenced to be in production or scalable beyond the author’s own use.

The description states:

• It was built for a hackathon
• Submitted to the OpenAI 2026 hackathon
• No mention of:
  • Customers
  • Users
  • Product adoption
  • Revenue
  • Product iteration or feedback loops

Not evidenced: No traction, usage data, or product maturity beyond a prototype.

The description does not mention:

• Competitors
• Existing tools in the email security or SOC automation space
• Market positioning relative to other solutions

Not evidenced: No competitive analysis or market context provided.

• Single-person project: No team, no product-market fit evidence.
• Hackathon prototype: Not a commercial-grade tool.
• No revenue or traction: No data on adoption or usage.
• Unverified claims: All functionality is self-reported without independent validation.
• Limited scope: Focuses only on email headers and IOC extraction — not a full security platform.

1. What specific email formats or header structures does the tool support?
2. How accurate is the phishing detection and IOC extraction in real-world scenarios?
3. Has the tool been tested with actual SOC workflows or integrated into existing systems?
4. Are there any plans to expand beyond email headers (e.g., attachments, URLs)?
5. What are the limitations of using a local LLM like Gemma 3 for this use case?
6. Is there any feedback from cybersecurity professionals who have tried it?