Research

Papers, case studies, and investigations. Insider threat models that transfer to AI agents. Whether LLMs stereotype cognitive disability. What happens to enterprise security docs when the product pivots. Each entry links to the paper, repository, or primary artifact at the top.

Showing all 7 pieces.

From Rogue Employees to Rogue Agents

From Rogue Employees to Rogue Agents

I took the anomaly detection models from my insider threat thesis and applied them to AI agent execution traces. The models transfer. An Isolation Forest trained on employee behavior retains 97% of its detection power on agent traces. The blind spots transfer too.

Neurodivergent Prompting: Do LLMs Stereotype Cognitive Disability?

Neurodivergent Prompting: Do LLMs Stereotype Cognitive Disability?

18,000 API calls across three models from three labs. Gemini stereotypes with Hollywood caricatures. Claude performs excessive uncertainty. GPT-5.4 is nearly immune. The cheapest models stereotype the most — and they're the ones in companion apps serving neurodivergent users.

Why We Stopped Trying to Be Smart: Building AI Systems the Feynman Way

We started with complex agentic workflows because they felt sophisticated. Production taught us that smartness is compounded over time, not front-loaded. Here's what we learned.

Insider Threat Detection: When the Attacker Already Has the Keys

My MSc thesis compared unsupervised anomaly detection methods for insider threats. The standard metric says Isolation Forest wins at 0.799 AUC-ROC. But the LSTM Autoencoder catches 3.4x more attacks at operational thresholds. How you measure matters as much as what you build.

Open Source Contributions to Fern API Docs

A customer needed things the Fern framework documentation didn't cover. I dug in, solved their problem, and contributed the improvements back upstream. Two PRs merged.

Documenting a Security Platform at Scale

Technical writing across six security product areas at Logpoint: SIEM, SOAR, UEBA, Director, Integrations, and Security Research. LaTeX compliance reports, cross-regional coordination, and customer support as a documentation feedback loop.

Replacing Zip Files with Actual Workflows

Modernized the documentation workflow for a Salesforce compliance platform: migrated from zipped Word files to online collaboration, implemented version control for audit compliance, and automated version numbering across dozens of files per release.