Before writing a single line of specification, I spent several years looking at the sea differently. As an officer with the « fusiliers marins », you learn to read a maritime zone as a threat in motion: who is transiting, who is deviating, who has switched off their transponder. That reflex does not switch off with the uniform, it only changes tools.
My training in geopolitics and geostrategy did the rest: the habit of placing a local event (a blockade, a ship seizure, a strike) into a chain of consequences, and of asking not “what happened” but “what does it shift”. That is the question AEGIS tries to mechanise.
What AEGIS is
AEGIS is an OSINT (Open-Source INTelligence) monitoring platform: it collects events, classifies them with AI, geolocates them and shows them on a live map, backed more recently by a dozen open data layers (maritime traffic, submarine cables, Internet outages, earthquakes, cyclones, ransomware, DDoS). Two things set it apart from yet another map:
-
A reframed question rather than one more layer. The free AIS feed sees neither Hormuz nor Bab-el-Mandeb, both out of reach of shore stations. So AEGIS changes the question: not “where is this ship” but “how many ships passed through this strait yesterday, and is that normal”. Across the 28 straits measured, the Cape of Good Hope is down 8.5% year on year while Suez is back up 7.9%. The Red Sea diversion is receding, measured, not inferred.
-
A contract of honesty rather than a plain feed. Every layer carries the state of its source: live, degraded, or not configured. A zone with no detections shows as “not observed”, never as “quiet”; an approximate position is drawn blurred, never sharp. The principle, already in place for AIS, now extends to every layer.
Vibecoding: directing rather than typing
I am not a developer by trade. AEGIS exists because I directed its construction in plain language: specifying, testing, correcting, rather than writing the code myself. That is vibecoding : describe the intent, review the result, iterate. Starting point: an open-source fork (globalthreatmap), grown with an AI agent, Hermes, then Claude Code.
Judgement matters more than syntax. Switching off a single layer used to bring down the whole application (a silent bug), the API answering 200 while nothing rendered: the most dangerous failure for a situational tool, a map that looks normal and is empty. The same restraint applies to the data: no “maritime piracy” layer, for want of a reliable source. A tool built by directing an AI is refused and audited like any other — the initial security audit (unauthenticated routes, bypassable rate limiting) had set exactly that rule.
Cutting cost to the bone
The original project relied on a paid search and analysis API. First job: remove it, collection now runs on DuckDuckGo and some forty RSS feeds, all free. Same logic for the AI: DeepSeek first, for cost, then Claude (Anthropic), with Haiku as the default model. That discipline governs every layer added since: no key, no subscription, or it does not enter the catalogue. The ACLED provider (armed conflict) was written all the way through (authentication, pagination, filters) before hitting a commercial wall: the account authenticates, access to the data does not. The code sits ready, unused; turning down a source you have already built is a cost decision too.
The rest of the budget comes down to three decisions:
-
Self-hosted on a Raspberry Pi5 at home rather than a cloud server rented by the month, reachable only over my private network, never exposed to the Internet.
-
Collection on demand, no background cron: the database only fills when someone opens the app: zero AI calls, therefore zero cost, when nobody is looking.
-
Systematic server-side rate limiting on every route that triggers AI, so that no usage, deliberate or not, can send the bill drifting.
Result: a threat intelligence platform running for a few euros a month, carried by hardware the size of a deck of cards.
I did not build a threat intelligence tool by accident. It is the extension of two worlds I have passed through: the navy, where the maritime picture is the intelligence, and competitive intelligence, where an event only has value once set against its consequences. AEGIS does not compete with professional platforms. It has neither their proprietary data nor their budget. But it asks a more interesting question than pure screening: that of second-order effects, what moves once the event has passed.
Above all, it is a demonstration that a project of this kind remains within reach of anyone who knows what they want to look at, without being an engineer, on a hobbyist's budget, by directing an AI the way you would direct a small technical team. The map, the measured straits, the AIS silences, the layers that would rather refuse than invent: that is what this way of working built, iteration after iteration.