Research & case studies
Studies in AI behavior and security, alongside case studies in documentation and engineering. The methods, results, and things that did not work.
Showing all 8 studies and case studies.
My MSc thesis compared unsupervised anomaly detection methods for insider threats. The standard metric says Isolation Forest wins at 0.799 AUC-ROC. But the LSTM Autoencoder catches 3.4x more attacks at operational thresholds. How you measure matters as much as what you build.
A chat-template audit and 259 AIME attempts on an RTX 4060. The suspected explanation didn’t hold; the run exposed a termination problem instead.
I took the anomaly detection models from my insider threat thesis and applied them to AI agent execution traces. The models transfer. An Isolation Forest trained on employee behavior retains 97% of its detection power on agent traces. The blind spots transfer too.
18,000 API calls across three models from three labs. Gemini stereotypes with Hollywood caricatures. Claude performs excessive uncertainty. GPT-5.4 is nearly immune. The cheapest models stereotype the most — and they're the ones in companion apps serving neurodivergent users.
A customer needed things the Fern framework documentation didn't cover. I dug in, solved their problem, and contributed the improvements back upstream. Two PRs merged.
We started with complex agentic workflows because they felt sophisticated. Production taught us that smartness is compounded over time, not front-loaded. Here's what we learned.
Six security product areas at Logpoint: SIEM, SOAR, UEBA, Director, Integrations, and Security Research. I didn't document a release until I'd installed it myself. Every new ISO went onto my own VM; every plugin got fed a log generator. Then I asked the questions QA hadn't.
Modernized the documentation workflow for a Salesforce compliance platform: migrated from zipped Word files to online collaboration, implemented version control for audit compliance, and automated version numbering across dozens of files per release.