AI agents#
Agents that make a verifiable decision or produce a checkable artifact, with an evaluation harness that measures them against what analysts or verified data say. Five projects, 2024 to 2026.
LLM agents for SOC alert triage#
Problem · A managed security provider's analysts triage a constant stream of alerts. Deciding true positive or false positive takes context: related events, earlier analyst decisions, ticket history and threat intelligence.
What I did · Built an agent that issues an explainable verdict per alert, grounded in that context: a semantic data lake over the telemetry, threat-intelligence enrichment, an evaluation harness against analyst ground truth, an HTTP API and an analyst console, a connector to the provider's search cluster, and a dataset anonymization process for safe experimentation.
Result · On hundreds of real alerts, the agent's verdicts agreed with the analysts' in the large majority of cases, highest on benign activity. A smaller model reached most of that accuracy at a fraction of the cost per alert.
Stack · LLM agents, DuckDB, Elasticsearch, FastAPI, Python, threat-intelligence APIs.
Agent-based data collection for infrastructure datasets#
Problem · Forecasting infrastructure costs needs thousands of completed projects with sourced costs, dates and attributes. The evidence exists, scattered across public reports, and collecting it by hand does not scale.
What I did · Built an agent-based research tool that assembles tabular datasets from public sources one sourced cell at a time. A rules file declares the columns, vocabularies, source tiers and scoring. A deterministic validator and quote verification against the downloaded documents keep every value traceable to its origin. Sessions run sandboxed, with cost tracking and resumable transcripts.
Result · Thousands of projects collected across five water-infrastructure asset classes, feeding the forecasting work for a UK regulator.
Stack · Claude-based agents, MCP tools, Python, Pydantic, DuckDB, sandboxed sessions.
Agentic analytics for intralogistics data#
Problem · A venture of a German intralogistics group wanted analysts to stop losing hours to weeks on ad-hoc questions about warehouse and production data, and asked whether LLM agents could answer them from raw system exports.
What I did · Built a proof of concept in which agents derive a semantic layer from raw WMS and ERP exports, then answer natural-language questions with SQL that can be checked, through a generate, validate and fix loop. Wrote an experiment harness that scores every answer against verified results, and delivered a white paper, an executive summary and an MVP plan.
Result · After one round of business context and source fixes, the agents produced near-perfect SQL on most datasets, at a cost of cents per question.
Stack · Pydantic AI, DuckDB, Ibis, Anthropic and OpenAI models, embeddings search, FastAPI dashboard, Logfire.
Agentic cybersecurity assessments#
Problem · A US security startup builds autonomous firewall defense for utilities and critical infrastructure. It needed to know how well LLMs handle defensive security tasks, and then a backend that finds misconfigured or rogue firewalls and explains the fix.
What I did · First benchmarked LLMs on firewall-misconfiguration scenarios with graded checkpoints, generating synthetic scenarios and fine-tuning. Then built the product backend: an API gateway and CLI, LLM analysis of device health and firewall logs, log parsing, and per-device and per-organization issue endpoints, integrated with a simulated-network benchmark.
Result · The backend prioritizes remediation actions with explanations that security teams can verify.
Stack · FastAPI, PostgreSQL, LLM APIs, Docker, Python.
LLM-powered data analyst for a US university#
Problem · The HR department of a US university wanted staff to ask questions of their own HR data without going through technical staff, and needed to know whether an LLM could do that reliably on real data.
What I did · Ingested the HR system into Snowflake with a cleaned data model, compared several models, and chose prompting with the schema and sample values over fine-tuning. Built an agent-based system that turns natural-language questions into SQL. When raw LLM accuracy fell short, moved to a simplified schema of common table expressions, which made the typeahead and SQL generation far more dependable. Shipped it as a Streamlit app inside Snowflake, then ran survey key-driver analysis in a second phase.
Result · The app is in use and automates routine questions, reducing analysts' workload. The client extended the engagement to a second phase.
Stack · Snowflake, Streamlit, LLM APIs, Terraform, CI.
Working on something similar?
The quickest way to find out whether I can help is a short call. Prefer email? Write to [email protected].