What are we working on?
Ask a question, create an output, or build an app that works with your tools and data.
Get Started
Build a store network security dashboard
Monitor POS threats, network segmentation, and security posture across 1,700+ stores
App
Monitor POS threats, network segmentation, and security posture across 1,700+ stores
Draft an e-commerce threat assessment report
Analyze bot attacks, credential stuffing, and payment fraud on fivebelow.com
Document
Analyze bot attacks, credential stuffing, and payment fraud on fivebelow.com
Build a Q3 security & compliance review deck
Pull data from vulnerability scans, PCI-DSS audits, and incident tracking
Slide Deck
Pull data from vulnerability scans, PCI-DSS audits, and incident tracking
Connect to our store network monitoring system and build a real-time security dashboard showing threat activity, POS health, network segmentation status, and security posture across all 1,700+ retail locations.
AI
I'll need access to your store network monitoring and POS security telemetry. Let me request that through a Gatekeeper.
Gatekeeper: Store Network Monitoring
Requesting read-only access to store security telemetry, POS health data, WAF block logs, and network segmentation status. The Gatekeeper holds the credential and logs every query.
Requesting read-only access to store security telemetry, POS health data, WAF block logs, and network segmentation status. The Gatekeeper holds the credential and logs every query.
Approved.
AI
Access granted. Pulling store security telemetry now.
Executed code
const storeData = await env.STORE_NETWORK.getSecurityTelemetry({
scope: "all-stores",
include: ["threats", "pos_health", "segmentation", "posture"]
});
const activeAlerts = storeData.incidents.filter(
i => i.severity === "critical" || i.severity === "high"
);
app.render(StoreSecurityDashboard, { storeData, activeAlerts });
AI
Store Network Security Dashboard is live. Connected via Gatekeeper -- read-only, every query logged.
I see 5 active alerts requiring attention, including a card skimming attempt detected at Store #1247 in Philadelphia. Want me to set up PagerDuty escalation if the POS block rate drops below 99%?
I see 5 active alerts requiring attention, including a card skimming attempt detected at Store #1247 in Philadelphia. Want me to set up PagerDuty escalation if the POS block rate drops below 99%?
+
Draft an e-commerce threat assessment report for fivebelow.com. Cover bot attacks, credential stuffing, payment fraud, and API abuse. Ground it in our current security policies and architecture.
AI
I'll pull from your company's context library to ground this in Five Below's security standards.
Context Library: Security & E-Commerce Architecture
Loading Five Below's security standards (v3.2), e-commerce architecture docs, WAF configurations, and bot management policies. These are curated by your security team and read-only to the agent.
Loading Five Below's security standards (v3.2), e-commerce architecture docs, WAF configurations, and bot management policies. These are curated by your security team and read-only to the agent.
AI
Context loaded. I've identified 4 key threat categories to address in the assessment:
1. Bot attacks -- sneaker bots, inventory hoarding, price scraping on high-demand drops
2. Credential stuffing -- targeting customer accounts and loyalty rewards
3. Payment fraud -- card testing, stolen card usage at checkout
4. API abuse -- rate limit evasion on product and inventory APIs
I'll structure the report with risk ratings and mitigation recommendations.
1. Bot attacks -- sneaker bots, inventory hoarding, price scraping on high-demand drops
2. Credential stuffing -- targeting customer accounts and loyalty rewards
3. Payment fraud -- card testing, stolen card usage at checkout
4. API abuse -- rate limit evasion on product and inventory APIs
I'll structure the report with risk ratings and mitigation recommendations.
AI
E-Commerce Threat Assessment Report v1.0 draft is ready. Structured per Five Below's security assessment framework with risk ratings and remediation timelines.
You can edit directly, export to Google Docs, or share with the security team for review. The document stays connected to the context library -- if security policies change, I can flag sections that need updating.
You can edit directly, export to Google Docs, or share with the security team for review. The document stays connected to the context library -- if security policies change, I can flag sections that need updating.
+
Build a Q3 security and compliance review deck summarizing our security posture improvements, PCI-DSS remediation progress, and upcoming initiatives. Pull data from ServiceNow and our vulnerability scanner.
AI
I'll need access to your incident tracking and vulnerability management systems.
Gatekeeper: ServiceNow (read-only)
Requesting access to the SECURITY and COMPLIANCE modules. Read incidents, change requests, and audit findings only.
Requesting access to the SECURITY and COMPLIANCE modules. Read incidents, change requests, and audit findings only.
Gatekeeper: Vulnerability Scanner (read-only)
Requesting access to scan results and remediation tracking. Read vulnerability data and SLA compliance only.
Requesting access to scan results and remediation tracking. Read vulnerability data and SLA compliance only.
Both approved.
AI
Executed code
const incidents = await env.SERVICENOW.getSecurityIncidents({
modules: ["SECURITY", "COMPLIANCE"],
quarter: "Q3-2026"
});
const vulns = await env.VULN_SCANNER.getScanResults({
scope: "all-assets",
since: "2026-07-01"
});
deck.generate(SecurityReview, { incidents, vulns });
AI
Q3 Security & Compliance Review deck is ready -- 4 slides from live ServiceNow and vulnerability scan data.
You can regenerate anytime to pick up changes, or edit individual slides. Export to Google Slides or PDF when ready to present to the board.
You can regenerate anytime to pick up changes, or edit individual slides. Export to Google Slides or PDF when ready to present to the board.
+
Gadget
Code
Connections
Store Network Security Dashboard
99.4%
WAF Block Rate
5
Active Threats
1.8M
Blocked Requests Today
94
Security Posture Score
Active Alerts
Card Skimming Attempt -- Store #1247 (Philadelphia) -- Anomalous POS terminal behavior detected. Terminal isolated, forensic capture initiated.
Credential Stuffing -- fivebelow.com -- 22K login attempts/hr from rotating proxies targeting customer accounts. Bot management engaged, 99.6% blocked.
Anomalous POS Traffic -- 3 Southeast Stores -- Unusual outbound connections from POS terminals in stores #892, #1104, #1338. Network segmentation rules holding.
TLS Certificate Expiry -- Distribution center DC-02 (Pedricktown, NJ) cert expires in 48 hours. Auto-renewal triggered, pending validation.
Inventory API Rate Limit -- Scraper bot cluster hitting /api/inventory at 8x normal rate. Rate limiting applied, monitoring for escalation.
Threat Severity by Service
E-Commerce Platform
96%
Secure
Inventory Management
93%
Secure
Supply Chain Portal
91%
Secure
POS Systems
89%
Secure
Employee HR Portal
85%
Secure
Store Wi-Fi Networks
78%
Monitor
Mobile App APIs
72%
At Risk
Page
Source
Connections
E-Commerce Threat Assessment Report v1.0
Five Below -- E-Commerce Threat Assessment
1. Purpose
This report provides a comprehensive threat assessment of Five Below's e-commerce platform (fivebelow.com), mobile application, and supporting APIs. It identifies active threat vectors, quantifies risk levels, and recommends mitigation strategies aligned with Five Below's security standards and PCI-DSS v4.0.1 requirements.
2. Scope
- fivebelow.com -- storefront, checkout, and customer account systems
- Five Below mobile application (iOS/Android)
- Product catalog, inventory, and pricing APIs
- Payment processing and tokenization services
- Customer loyalty and account management [NEW]
3. Threat Categories
| Threat | Description | Risk | Status |
|---|---|---|---|
| Bot Attacks | Sneaker bots and inventory hoarding during high-demand product drops; price scraping from competitor bots | Critical | Active mitigation |
| Credential Stuffing | Automated login attempts using breached credentials targeting customer accounts and stored payment methods | Critical | Active mitigation |
| Payment Fraud | Card testing via low-value transactions, stolen card usage at checkout, gift card fraud | High | Under review |
| API Abuse | Rate limit evasion on product/inventory APIs, unauthorized data scraping, API key exposure | High | Monitoring |
| Supply Chain Risk | Third-party JavaScript dependencies, vendor portal access, CDN integrity | Medium | Assessment scheduled |
4. Mitigation Phases
| Phase | Description | Duration | Gate |
|---|---|---|---|
| 1. Immediate | Deploy advanced bot management, enforce MFA on customer accounts with stored payment | 2 weeks | Bot score > 95% accuracy |
| 2. Short-term | Implement API gateway with per-client rate limiting, deploy fraud scoring on checkout | 4 weeks | Fraud rate < 0.02% |
| 3. Medium-term | Third-party script auditing, SRI enforcement, vendor access review | 6 weeks | Zero unauthorized scripts |
| 4. Ongoing | Continuous threat monitoring, quarterly pen testing, red team exercises | Continuous | Quarterly review |
PCI-DSS v4.0.1 Requirement: All e-commerce payment pages must implement client-side script inventory and integrity verification by March 2027. Phase 3 activities address this requirement directly.
5. Incident Response Procedures
| Trigger | Action | RTO |
|---|---|---|
| Bot traffic spike > 5x baseline | Activate JavaScript challenge on all product pages, notify merchandising | < 2 min |
| Credential stuffing > 10K attempts/hr | Enable CAPTCHA on login, force password reset on compromised accounts | < 5 min |
| Payment fraud rate > 0.05% | Escalate fraud scoring threshold, enable manual review queue | < 10 min |
| API abuse detection | Revoke API keys, block source IPs, rotate client secrets | < 3 min |
Slides
Source
Connections
Q3 Security & Compliance Review
Integrations
Connect external services to Five Below OS. Gatekeepers govern access, scope permissions, and log every action.
Gatekeepers
Google Workspace
Gmail, Docs, Sheets, Slides, Calendar, Drive
Slack
Send messages, read channels, manage workflows
Jira
Projects, epics, issues, sprints, and boards
Confluence
Read and write wiki pages, search spaces
GitHub
Access repositories, create PRs, manage issues and actions
PagerDuty
On-call schedules, incident alerts, and escalation policies
Splunk / SIEM
Security events, alerts, monitoring, and correlation data
ServiceNow
IT tickets, change requests, CMDB, and incident management
Snowflake
Data warehouse, analytics, cross-department reporting
Grafana
Dashboards, observability, metrics, and alerting
Workday
Employee data, org charts, payroll, time off, benefits
Datadog
APM, infrastructure monitoring, log management, and tracing
MCP Servers
Remote MCP servers available to all workspaces.
Store Network Monitoring
https://stores.mcp.fivebelow.internal/mcp
Auto
E-Commerce Platform API
https://ecom.mcp.fivebelow.internal/mcp
Needs auth
POS Security Engine
https://pos.mcp.fivebelow.internal/mcp
Auto
Inventory & Supply Chain
https://supply.mcp.fivebelow.internal/mcp
Needs auth
Cloudflare API
https://mcp.cloudflare.com/mcp
Auto
Context
Curated reference documents that ground your agent in Five Below's knowledge. Published centrally, read-only to all agents and workspaces.
company-strategy-fy2027.md
Five Below's growth strategy, store expansion plans, digital transformation objectives, and key results by business unit
security-standards.md
Retail security policies, PCI-DSS v4.0.1 requirements, POS security controls, and data protection standards
architecture-principles.md
Platform architecture standards, microservices guidelines, store systems architecture, and technology radar
api-design-guidelines.md
REST API conventions for e-commerce and store systems, versioning policy, rate limiting, and developer standards
compliance-framework.md
PCI-DSS, SOC 2, CCPA, state privacy laws, retail-specific regulatory requirements, and audit procedures
infrastructure-inventory.md
Store systems catalog, e-commerce platform, distribution center infrastructure, SLAs, and dependency mappings
developer-standards.md
Coding standards, CI/CD pipeline requirements, testing coverage thresholds, and release procedures
risk-management-playbook.md
Fraud detection models, loss prevention procedures, transaction monitoring thresholds, and chargeback management
network-architecture.md
Store network topology, SD-WAN architecture, POS network segmentation, Wi-Fi policies, and distribution center networking
incident-management.md
Incident response procedures, store security escalation paths, post-mortem templates, and war room protocols
Skills
All
Security
Engineering
Infrastructure
General
| Name | Description | Group | Source |
|---|---|---|---|
| meeting-prep | Scan calendar, gather context from connected systems, and generate briefing docs | General | Five Below |
| weekly-report | Compile team activity summaries from Jira, Slack, email, and calendar data | General | Five Below |
| threat-assessment | Analyze threat intelligence feeds, correlate attack patterns, and generate risk briefings | Security | Five Below |
| pos-security-audit | Audit POS terminal configurations, validate encryption standards, and flag anomalies across store fleet | Security | Five Below |
| compliance-audit | Gather PCI-DSS/SOC 2 compliance evidence, map controls, and generate audit packages | Security | Five Below |
| incident-response | Draft or update incident response policies grounded in Five Below security standards and NIST | Security | Five Below |
| vulnerability-triage | Prioritize CVEs against Five Below's asset inventory, assign owners, and track remediation SLAs | Security | Five Below |
| bot-detection-tuning | Review bot management performance, adjust scoring thresholds, and generate tuning reports for e-commerce | Security | Five Below |
| architecture-review | Build quarterly architecture review decks from Jira and Confluence data | Engineering | Five Below |
| api-catalog | Discover, document, and visualize internal API endpoints with ownership and health | Engineering | Five Below |
| service-health | Generate service reliability reports from monitoring data, SLO tracking, and incident history | Engineering | Five Below |
| deployment-runbook | Create step-by-step deployment guides with pre-checks, rollback procedures, and verification | Engineering | Five Below |
| store-network-health | Monitor store network connectivity, SD-WAN performance, POS uptime, and Wi-Fi health across all locations | Infrastructure | Five Below |
| capacity-planning | Forecast compute, storage, and network capacity needs based on seasonal traffic and store growth | Infrastructure | Five Below |
| edge-optimization | Analyze CDN performance, cache hit ratios, and latency distribution for fivebelow.com optimization | Infrastructure | Five Below |
| cost-optimization | Cloud and infrastructure spend analysis, trend visualization, and optimization recommendations | Infrastructure | Five Below |
| change-impact | Analyze change impact across store and e-commerce systems, map dependencies, and identify affected teams | Engineering | Five Below |