Research area

AI detection engineering

Putting models and agents into the detection pipeline, and measuring what they actually produce.

2026

Making Sense of 1.6 Million Process Execution Events, Part 1: Finding the Structure A fully local pipeline that turns 1.6 million Windows process execution events into 140 groups an analyst can review, with every step measured, a plain account of the one thing it cannot do, and a free tool to run it on your own data.

Oct 2026

Understanding How LLMs Process Security Telemetry What a language model actually does with a command line, measured on Phi-4-mini and on two days of real Sysmon events, and what to do before you paste telemetry into one.

Oct 2026

All research →