Project Description

Employer case study · BlackCloak

The phishing analyzer

At BlackCloak — digital executive protection — analysts reviewed phishing submissions for high-profile clients. Each review started with up to an hour of manual prep.

The problem

Phishing triage meant reading every message by hand before analysis could even begin. And the obvious shortcut — paste it into an LLM — was off the table: client messages are exactly the data you can’t hand to a third-party model raw.

What I built

An AI phishing analyzer with the guardrail built in first: an NLTK token-scrubbing layer strips names, addresses, and identifiers before the LLM ever sees the message. AI does the reading; the sensitive data never leaves the building.

Privacy layer first

NLTK-based token scrubbing sanitizes every message before analysis — the guardrail is the architecture, not an afterthought.

LLM analysis

ChatGPT reads the sanitized message and surfaces intent, urgency cues, and indicators in moments.

Analyst-ready output

The analyst starts from a structured read-out instead of a raw inbox — prep collapsed from an hour to moments.
1 hr → min
prep per review
120+
analyst hours saved
100%
PII scrubbed pre-LLM
2022
before it was cool

Early proof of the thesis this business runs on: AI does production work when you build the harness around it — guardrails first, model second.

The same discipline runs this business today.

Angel Menendez

Written by

Angel Menendez

Founder & Principal AI Systems Architect