What is CITY? Five years of digital infrastructure, unearthed and turned into a city everyone can see

01August 2026: we took stock of five years of digital infrastructure

In early August 2026, Teleport was about five years old. Systems built by people who came before us, services spun up for testing: old things were left all over our digital infrastructure.

We’re a small generative AI startup, with no system administrator keeping strict control. And with AI, you can build all sorts of things very quickly. So we casually published things, took them private, and published them again.

We agreed this really wasn’t okay anymore, so we set out to clean up five years’ worth of servers, email, programs, public-facing servers and more. It was genuinely hard. Harder than developing something new, to the point that we couldn’t get any other work done.

02We understood 70%. The other 30% we didn’t, and 10% made no sense at all

What you know, you figure out right away: how the mail server is set up, how the web server is set up.

But then domains and web services that no one on the current team knew about turned up. Tracing them back, some had been made by someone who worked here five years ago, others by a contractor we hired briefly two years ago. We didn’t know whether we could even reach them. On top of that, we had no standard for how far we needed to dig.

For a large company with a security firm under contract, an IT department and strict rules, this might not be much of a problem. But at a small or midsize business, there often aren’t strict rules for computers, and people use smartphones and PCs freely, some of them bought personally. Is some department managing all that? I think more companies aren’t than are. We weren’t.

Even with a single office PC, you don’t know what the files on it are. Servers are even worse. For example, someone at the company had signed up three years earlier for a WordPress server, the kind that was in the spotlight in this PHP incident. What was it being used for?

We run experiments, and the business keeps growing. Here is what we found.

We could gather information on up to about 70%. But 30% we didn’t understand, and about 10% of it made no sense at all. From here, we had to get serious.

03“Unknown” is not the same as “doesn’t exist”

Is it unknown? Does it not exist? Or is something that should exist missing? From here on, it starts to become a specialist security topic.

In system administration and security, distinctions like “Is it unknown, or does it not exist?”, “Something is there, but we don’t know what it is,” and “It’s there, but the lock won’t open” really matter.

How should we organize it all? There was no way out anymore. So we researched thoroughly how this field handles things that are known, unknown, existing, nonexistent and invisible.

04We wrote it all in a fixed format and dug it up with AI agents

What we learned was that this kind of information is best recorded in a consistent format. But there is no established way to write it. We stitched together pieces from academic research, system administration and other fields, and took what we needed.

Using those rules, we went back and searched again for the people responsible, the systems, the passwords, and what each thing had been for. Over days and days, we uncovered a huge amount of data. It really felt like an excavation.

We couldn’t do it with people alone, so naturally we used AI agents too. The information we needed was scattered everywhere: deep in Google Drive, deep in someone’s hard drive. Embarrassingly, even when we gathered the scattered pieces, if we didn’t write them in a consistent format according to fixed rules, it all turned into a mess, and quickly became a mess again.

That is how we built up the data format we call CITY, along with know-how for gathering and managing information.

We’re a small company, so we can’t have someone dedicated to this. But just organizing and managing the data we had collected felt like it was eating up one employee’s entire time.

So once again, AI agents stepped in. Working with us to shape the rules, the AI agents manage, update and organize the data, and go looking for whatever is unknown. It really felt like being an excavator, or a detective. Along the way, the data format and the agents matured, and the agents came to work under fixed rules.

05We organized it perfectly, and still no one could take it in

Then the next problem appeared. We had gathered a vast amount of data, and both what we knew and what we didn’t were clearly written in it. And yet people couldn’t grasp it.

This truly stunned us. Over many days, the whole company had salvaged data and organized it with the agents. It should have been perfectly organized, but whether we printed it or put it on screen, our brains just couldn’t keep up.

The engineer who had worked hardest on it could understand it, of course. But we’re a company of only a few people, so everyone should understand it. That led to a question: has anyone ever actually seen digital infrastructure? Everyone was imagining it in their heads, and each of us was picturing something different.

06In 3D, a city emerged from the data

So we decided to try making it 3D, and built it with AI agents. Then, out of the data, roads and buildings like a city’s emerged.

The screens from here on are examples built with a fictional company’s information for the film.

1. 1GitHub building (code)
2. 2AWS block
3. 3Lines connecting buildings

We put it on a big monitor in the office and talked it through with the agent, pointing as we went: “So this is how this worked,” “This is the problem,” “This part is pretty well organized.”

We walked around inside it, spun it around, and looked from above and below, saying things like “This part’s defenses are a bit weak,” “We don’t know what data is on this server,” “This one’s locked, so we can’t open it,” and “We haven’t searched around here yet, so it’s foggy.”

07What CITY shows you about a company’s digital infrastructure

People and agents checking a city-like digital infrastructure together, in 3D and in real time. That is how we finally understood what our digital infrastructure was, where its problems were, what we could and couldn’t see, and how big it was.

(The three-minute video “How to read CITY” walks through the buildings, heights, lines and colors on screen one by one.)

If something goes wrong, who contacts or notifies whom, and how? Where are we being billed? Which credit card is linked to which account? Everything became visible.

The AI agents also flag new changes.

1. 1Date the AI agent redrew it
2. 2Marks for changes that appeared that day
3. 3Block outlined with a red dotted line

We gave this data format the name CITY. Today, we call the whole thing CITY, including the screen that shows it as a city and the AI agents that maintain and explain it. Inside Teleport, everyone can now see our digital infrastructure with their own eyes. Open a laptop, and CITY tells you the state of our servers, accounts and payment information, and we can discuss things while looking at it.

1. 1Three things found in the inventory
2. 2Identity core (accounts)
3. 3AWS (cloud) block

1. 1Check marks on closed items
2. 2Closed one by one, with reasons recorded

08The PHP night began with calling an agent into a chat

That was when the PHP incident happened.

PHP is a programming language that runs on the servers of many websites around the world. On October 21, 2026, a fix for a critical vulnerability in it was released, and many services, including banks and online shops, temporarily shut down to protect themselves.

We simply opened CITY, called the agent and asked, “How does this issue affect us?” In about five minutes, our AI agent replied, “There is one PHP instance here. It was used by so-and-so in such-and-such a month and year.”

Here is how the exchange went from there.

This conversation took place on a chat screen: LINE, to be specific. Our agent system can join any chat tool, whether LINE, Slack or Discord. So we can call a security agent into LINE and talk there, or talk in Slack.

There’s no need to sit down at a computer, either. CITY’s 3D map can be viewed on a smartphone, so while talking with the agent on a phone, we spun CITY around together, took action, and finished the whole response within 30 minutes.

It’s a little frightening to imagine what would have happened without CITY, or without the agents. Because we had spent days and days in August searching, digging things up and building CITY, it was over in 30 minutes and nothing happened. If that server had been running, if PHP had been used more widely, and if it had been built by our predecessor or the one before that, we wouldn’t even have known where it was. So we told each other, “Good thing we built CITY.”

09We aren’t security professionals. Here’s why we are sharing CITY anyway

Normally, the story would end here. But then a thought struck us.

Afterward, various services went down, and many people became very afraid of AI-driven attacks and AI security. People around us said things like “I’m a bit scared to use the internet” and “What if my passwords get stolen from all these services?” Engineers stayed overnight, unable to go home, scrambling to respond. Truly many services went down, one after another.

We’re not a security company, and we’re not security professionals. When it comes to protecting systems, we’re not professionals at all. But when it comes to making things visible so everyone can look at them together, and to developing and operating AI agents, we can say with confidence that we are professionals.

What we did was make digital infrastructure that had been invisible for decades viewable by anyone, like a game screen, and provide AI agents that explain it and AI agents that manage and maintain it. The agents go out on their own, daily or weekly, to find security news, then report and explain whether we need to act. We run that system in-house.

In that case, we thought, getting CITY to many people might be a good thing to do in this field.

At the same time, there is the problem of information and AI security literacy. What is okay to do, what should you do, and what must you not do? Information on this is tangled and contradictory. There are media for security and systems specialists, and visualization tools for specialists. But for executives, employees and people at ordinary small and midsize businesses, there is surprisingly nothing.

So the morning after the PHP incident, we talked it over inside the company and launched the Data is CITY project.

10Getting started with CITY takes a few days of discovery

Even when you actually use CITY, gathering the information at the start takes real effort, because it is a kind of excavation. But if you search following the CITY format we built, using agents along the way, I think you can probably reach a point where you understand your information, at least for now, within a few days.

Once you are there, you can view it on a PC or a smartphone. Ideally everyone looks at it together, so put it on a large display or a projector, and at last everyone can see the company’s digital infrastructure together.

There, not just mail servers and web servers but where various passwords and keys are stored, domains, file storage, everything is laid out like a city. You can also see how data moves and what depends on what.

CITY is not yet publicly available. People who join the waitlist can try it before the general release.

Here is what CITY aims to deliver:

• Everyone in the company, executives especially, can see the digital infrastructure that no one could see until now
• Everyone can look at the same thing and talk it through
• You can talk things through with AI agents too, and even leave countermeasures to them

Because we’re not a security company, what we can confidently say we deliver properly goes as far as making things visible and proposing countermeasures.

And because this touches on security, we felt it wouldn’t be right for a company like ours to release it as a black box. So for now, we are thinking of making the core of CITY open for anyone to see, including its source code.

11“Isn’t it dangerous to gather everything in one place?” What we think for now

There are questions we often get:

• Doesn’t using CITY actually make security riskier?
• Isn’t gathering information in one place more dangerous?
• If the source code is visible, can’t people use it to do harm?

We think it is basically fine. When we actually make things visible, we keep important information hidden in situations where everyone is looking together. People say gathering things in one place is the problem, but it is also important to make sure that place isn’t breached. There is also the view that things being scattered where no one understands them is actually more dangerous. Each of these, one by one, becomes a security question in its own right.

12The first releases from Data is CITY Media: a film and classroom slides

So far, I have talked about why CITY was born and how we use it.

What matters most, I think, is IT literacy and accurate information. Through Data is CITY Media, we want to raise AI literacy together with everyone, and deliver security news in a form that anyone who wants to understand it can understand, not just specialists.

As our first releases, we published a film of just over eight minutes and AI security slide materials for elementary, junior high and high school students. We will also keep adding information you can use at work and in all kinds of projects.