Why chat
Chat is where the team already is. Putting the data behind a login means it gets checked when something is already wrong. Putting it in chat means it gets checked casually, which is when noticing something is cheap.
Build
- Zoom Team Chat bot with slash commands, running through a Zoom OAuth app against internal service APIs.
- On-demand operational stats without a console login or a context switch.
- Ticket and time-entry confirmations posted back to the channel as they happen.
Where it became a security tool
The bot already had a channel, an API surface, and the team's attention. Adding sign-in triage to it cost almost nothing and removed the slowest part of the response loop.
When a suspicious sign-in fires, the bot performs the lookup a responder would have done by hand: address reputation, network ownership, geolocation, and whether the source looks like a datacenter or an anonymizing service. It posts the result to the owning channel with enough detail to escalate or dismiss.
