029 - Svalinn - Philadelphia Federal Reserve

Svalinn is a lightweight, cloud-hosted security tool for detecting misuse of enterprise AI assistants, with Microsoft Copilot as the reference platform. The system collects Copilot audit events alongside user logins and file-access logs to detect AI-specific misuse, such as the exposure of sensitive files outside a user's normal activity, sudden spikes in the number of documents retrieved, and unusual behaviors that suggest prompt injection or data harvesting. Upon detecting suspicious activity, the tool automatically correlates events, builds an incident timeline, assigns a risk score, and uses AI to analyze the collected evidence, classify the suspected misuse, and present a security analyst with a plain-language explanation and next recommended steps. Detection uses transparent, rule-based analysis of logs in Microsoft's standard audit format, while AI assists with incident investigation and interpretation, without requiring a full enterprise security platform.