Work · Client · the firm · 2026
AI triage for security operations
An LLM-and-retrieval pipeline that turns security alerts into scored, prioritised tickets, with redaction and audit logging.
What was built
- Retrieval over a vector store and a self-hosted model for triage
- Confidence scoring, PII redaction, audit logging
- Kubernetes deployment and a load-testing harness
What happened
Phase one accepted. Retrieval agreement went from near chance to 0.88–0.91 once a harness defect — it was measuring the harness, not the model — was found and fixed.
What it taught me
The absence of an outage is not evidence that a pipeline works. A silent rollback can hide a broken release process indefinitely.