diff --git a/Attack_Simulation/README.md b/Attack_Simulation/README.md
new file mode 100644
index 0000000..737f56e
--- /dev/null
+++ b/Attack_Simulation/README.md
@@ -0,0 +1,41 @@
+| Time  | Event |
+|--------|-------|
+| 09:40 | Unusual volume of `POST` requests to `/api/login` detected from a single IP. |
+| 09:42 | Failed login attempts exceed **300** within one minute. |
+| 09:44 | No rate limiting or temporary IP blocking was triggered. |
+| 09:46 | One login attempt succeeds using a password from a common wordlist (e.g., `rockyou.txt`). |
+| 09:47 | The server issues a valid JWT for the compromised account. |
+| 09:49 | The attacker uses the JWT to access `/api/users/me`. |
+| 09:51 | The attacker begins probing undocumented API endpoints (shadow APIs). |
+| 09:54 | Sensitive data is exfiltrated through repeated API requests. |
+| 09:58 | The SOC team detects the incident through a SIEM alert triggered by an abnormal spike in HTTP 401 responses. |
+
+
+## Incident Response Plan
+
+### 1. Identification
+- Review API, application, and authentication logs.
+- Identify the source IP addresses responsible for the brute force attack.
+- Determine which user accounts were compromised.
+- Analyze the scope of the data accessed or exfiltrated.
+- Correlate events using the SIEM to establish the attack timeline.
+
+### 2. Containment
+- Block the attacker's IP address using the firewall or Web Application Firewall (WAF).
+- Temporarily disable the compromised user account.
+- Revoke all active JWT access tokens and terminate existing sessions.
+- Enable temporary rate limiting on the `/api/login` endpoint.
+- Isolate affected containers if compromise is suspected.
+
+### 3. Eradication
+- Reset passwords for affected accounts.
+- Remove any malicious processes or unauthorized changes.
+- Patch the authentication service to enforce rate limiting and account lockout.
+- Verify container images for integrity and rebuild compromised containers from trusted images.
+- Scan systems for indicators of compromise (IOCs).
+
+### 4. Recovery
+- Restore normal service after confirming the environment is secure.
+- Re-enable affected user accounts with new credentials.
+- Continue monitoring logs for suspicious authentication attempts.
+- Validate that security controls (MFA, rate limiting, monitoring) are functioning correctly.
diff --git a/Security_Audit/security_audit.sh b/Security_Audit/security_audit.sh
new file mode 100644
index 0000000..6cb2b73
--- /dev/null
+++ b/Security_Audit/security_audit.sh
@@ -0,0 +1,79 @@
+#!/bin/bash
+
+# -------------------------------
+# Security Audit Script
+# 1. Port Scan
+# 2. SSL Certificate Check
+# 3. Rate Limit Test
+# -------------------------------
+
+if [ $# -lt 3 ]; then
+    echo "Usage: $0 <IP_ADDRESS> <DOMAIN> <LOGIN_API_URL>"
+    echo "Example:"
+    echo "./security_audit.sh 192.168.1.10 ghaymah.systems https://ghaymah.systems/api/login"
+    exit 1
+fi
+
+TARGET_IP=$1
+DOMAIN=$2
+LOGIN_URL=$3
+
+OUTPUT="security_report.txt"
+
+echo "===================================" | tee $OUTPUT
+echo "      Security Audit Report         " | tee -a $OUTPUT
+echo "===================================" | tee -a $OUTPUT
+echo "" | tee -a $OUTPUT
+
+###################################################
+# 1. Port Scan
+###################################################
+
+echo "[1] Scanning Open Ports..." | tee -a $OUTPUT
+echo "-----------------------------------" | tee -a $OUTPUT
+
+nmap -p- -sV --open $TARGET_IP | tee -a $OUTPUT
+
+echo "" | tee -a $OUTPUT
+
+###################################################
+# 2. SSL Check
+###################################################
+
+echo "[2] Checking SSL Certificate..." | tee -a $OUTPUT
+echo "-----------------------------------" | tee -a $OUTPUT
+
+echo | openssl s_client \
+-connect ${DOMAIN}:443 \
+-servername ${DOMAIN} 2>/dev/null \
+| openssl x509 -noout -dates -issuer -subject \
+| tee -a $OUTPUT
+
+echo "" | tee -a $OUTPUT
+
+###################################################
+# 3. Rate Limit Test
+###################################################
+
+echo "[3] Testing Rate Limiting..." | tee -a $OUTPUT
+echo "-----------------------------------" | tee -a $OUTPUT
+
+for i in {1..20}
+do
+    RESPONSE=$(curl -s \
+        -o /dev/null \
+        -w "%{http_code}" \
+        -X POST "$LOGIN_URL" \
+        -H "Content-Type: application/json" \
+        -d '{"username":"test","password":"wrong_password"}')
+
+    echo "Request $i -> HTTP $RESPONSE" | tee -a $OUTPUT
+
+    sleep 0.1
+done
+
+echo "" | tee -a $OUTPUT
+echo "===================================" | tee -a $OUTPUT
+echo "Audit completed successfully."
+echo "Report saved as: $OUTPUT"
+echo "==================================="
\ No newline at end of file
diff --git a/security_report.txt b/security_report.txt
new file mode 100644
index 0000000..c886b40
--- /dev/null
+++ b/security_report.txt
@@ -0,0 +1,7 @@
+===================================
+      Security Audit Report         
+===================================
+
+[1] Scanning Open Ports...
+-----------------------------------
+Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-27 19:50 +0300