🔐 BDO CyberAuditBot

An AI-powered assistant for cybersecurity compliance audits, powered by LLM (GPT-4o) and RAG (Retrieval-Augmented Generation). Designed to support BDO Singapore's audit teams with precise, document-based responses and automated technical pentesting reports.

---

📖 Project Background

Project Origin & Motivation

BDO CyberAuditBot was conceived as a personal initiative following six months of intensive collaboration with BDO Singapore's cybersecurity audit team. Throughout this engagement, recurring challenges were identified:

• Information Accessibility: Difficulty navigating multiple compliance frameworks and internal policies
• Time Efficiency: Manual document review consumed significant resources
• Consistency: Lack of standardized, document-backed responses
• Report Generation: High manual effort required for pentesting reports

This project serves as a starting point for modernizing audit workflows through AI.

---

Scope & Current State

Proof-of-concept demonstrating RAG + LLM applied to compliance auditing:

• Document-based Q&A
• Multi-format ingestion
• Automated report generation
• Framework integration

Future iterations will expand analytics, integrations, and coverage.

---

✨ Key Features

• 💬 Conversational Chatbot: Ask questions about cybersecurity audits, compliance frameworks, and best practices
• 📄 Dynamic Document Upload: Enrich your knowledge base with PDF, JSON, XML, or config files on-the-fly
• 📊 Automated Report Generation: Generate professional technical pentesting reports in DOCX format
• 📚 Source Citation: Every answer includes explicit source references from your indexed documents
• 🌍 Multi-Language Support: Responds in the same language as your query
• 🔒 Regulatory Aligned: Covers Singapore (PDPA, MAS), ISO 27001, NIST CSF, and other frameworks

---

🏗️ Architecture Overview

This project leverages:

• OpenAI GPT-4o for intelligent question-answering
• Chroma Vector Database for semantic document indexing and retrieval
• LangChain for document processing and RAG orchestration
• Gradio for a modern, user-friendly web interface

---

🚀 Quick Start

Prerequisites

• Python 3.9 or higher
• OpenAI API Key (GPT-4o access)
• Required asset files in the same directory as chatbot.py:
  • BDOagent2.png
  • user_avatar2.png
  • banner.png
• Reference PDFs folder: cybersecurity_pdf_data/

Installation

1. Clone or download this repository:

   git clone <repository-url>
   cd Chatbot-Rag-ReportGenerator

2. Install dependencies:

   pip install -r requirements.txt

3. Configure your API key:

   cp .env.example .env

   Then edit .env and add your OpenAI API key:

   OPENAI_API_KEY=sk-your-api-key-here

4. Prepare your knowledge base:

   • Create a folder named cybersecurity_pdf_data/ in the project root
   • Add your reference PDFs to this folder

5. Run the application:

   python chatbot.py

   The application will automatically open in your default browser at http://localhost:7860

---

📖 Usage Guide

Asking Questions

Simply type your question in the chat interface. The chatbot will:

• Search your indexed documents using semantic similarity
• Generate answers based strictly on the retrieved content
• Cite the source document and section
• Respond in your language

Uploading Documents

Use the upload sections to add new documents:

• PDF Files: Research papers, policy documents, standards
• JSON Files: Configuration files, structured data
• XML Files: Configuration hierarchies
• Text/Config Files: System configurations, logs

Generating Reports

1. Have a conversation with the chatbot about audit findings
2. Click "Generate & Download Report"
3. The system will create a professional DOCX report including:
   • Vulnerability details
   • CVSS scores and CWE classifications
   • Risk levels and business impact
   • Mitigation recommendations
   • Source documentation references

---

📋 Use Cases

Scenario	Application
Internal Audit Support	Get instant, document-based answers for BDO Singapore's cybersecurity audits
Compliance Verification	Check alignment with MAS, PDPA, ISO 27001, NIST, COBIT frameworks
Evidence Collection	Upload audit logs and findings to enrich context
Report Generation	Produce structured pentesting reports for clients/internal review
Team Training	Use as a knowledge base for auditors and compliance staff

---

🔐 Security Best Practices

• ⚠️ Never commit your .env file to version control
• 🔑 Keep your API key confidential and rotate regularly
• 📦 Session Isolation: Uploaded files are indexed only for your current session
• ✅ Source Verification: All responses are strictly based on indexed documents
• 🚫 No Fabrication: The system won't infer information beyond document scope

---

📁 Project Structure

Chatbot-Rag-ReportGenerator/
├── chatbot.py                    # Main application entry point
├── requirements.txt              # Python dependencies
├── .env.example                  # Environment variables template
├── readme.md                     # This file
├── BDOagent2.png                # Bot avatar
├── user_avatar2.png             # User avatar
├── banner.png                   # Application banner
└── cybersecurity_pdf_data/      # Reference PDFs (to be added)
    └── ... (your compliance documents)

---

🔧 Configuration & Customization

Environment Variables

Edit your .env file to configure:

• OPENAI_API_KEY: Your OpenAI API key

Modifying the Knowledge Base

The default PDF directory can be modified in chatbot.py:

pdf_dir = '../CyberAudit_Rag/cybersecurity_pdf_data'

RAG Settings

Adjust RAG performance by modifying chunk parameters in chatbot.py:

splitter = RecursiveCharacterTextSplitter(
    chunk_size=500,      # Size of document chunks
    chunk_overlap=10     # Overlap between chunks
)

---

🐛 Troubleshooting

Issue	Solution
OPENAI_API_KEY is not configured	Check your .env file and ensure the API key is set correctly
Module not found	Run pip install -r requirements.txt
Permission denied on chroma index	Ensure write permissions in your home directory
Image not found warnings	Place PNG files in the same directory as chatbot.py
No answers from chatbot	Verify PDFs are in cybersecurity_pdf_data/ and properly indexed

---

📚 Supported Compliance Frameworks

• 🇸🇬 Singapore: PDPA, PDPC Guidelines, MAS TRM Guidelines
• 🏦 Banking: MAS Notice 626, Financial Services Standards
• 🔐 International: ISO/IEC 27001, NIST Cybersecurity Framework, COBIT
• 🎯 Methodologies: OWASP, MITRE ATT&CK

---

🤝 Contributing

To improve this project:

1. Report issues or suggest enhancements
2. Update documentation with new frameworks or procedures
3. Add reference materials to the knowledge base
4. Share audit best practices

---

⚖️ License

This project is designed for BDO Singapore's internal use. Please review your organization's policies regarding licensing and usage.

---

📬 Support & Contact

For questions, issues, or support:

• Author: Carlos Egana
• Organization: BDO Singapore
• Location: Singapore

For technical issues or feature requests, please contact the project maintainer or your internal IT/Compliance team.

---

📝 Version History

• v1.0 (Current): Initial release with RAG-powered Q&A and automated reporting

---

Last updated: 2026-03-28 12:19:38