I follow the signal until the story makes sense.

A selection of real-world investigations across insider risk, security engineering, and AI-assisted analysis. Names and sensitive details are anonymized, but the investigative process, decisions, and outcomes are preserved.

Giving analysts the evidence before the alert

I built an AI investigation agent that correlated endpoint, identity, DLP, cloud, VPN, and physical-access data into an evidence packet for analyst review and judgment.

Role Investigation architecture
Systems Endpoint · Identity · DLP · Cloud · VPN
Outcome Faster first-pass evidence
Read case

Other selected work