AI SOC How To Build Graph-Based AI SOC Agents The Best Way James Bower, October 12, 2026October 12, 2026 Can an AI SOC agent do real work in a SOC without us hand-holding every decision? And how do we build it so that every alert, every correction, and every missed detection makes the next version better? I’ve been doing this for a few years now but haven’t really written… Continue Reading
Detection Engineering Detection Rule Staleness: How AI Can Solve This Now James Bower, April 20, 2026April 24, 2026 Your detection rule staleness is leaving you vulnerable, and you don’t know it. Here’s a scenario I’ve watched play out more times than I’d like. Six months ago, we wrote a Sigma rule for T1059.001 – PowerShell. We tagged it to the technique, PySigma parsed it clean, CI went green,… Continue Reading
Python How to Think About Low-Latency Development with Python James Bower, November 3, 2024September 17, 2026 Python is nobody’s first choice for low-latency systems. It’s interpreted, it has the GIL, and its dynamic typing adds overhead that compiled languages don’t have. Yet many of us build performance-sensitive systems in Python anyway, because the ecosystem, the iteration speed, and the team’s familiarity make it the pragmatic choice…. Continue Reading
Machine Learning Managing Noise In AI Security Machine Learning James Bower, October 14, 2024October 15, 2024 Understanding the various types of noise in cybersecurity is essential for developing robust machine-learning models capable of effectively detecting and mitigating threats. By recognizing how different noise patterns manifest within security data, practitioners can enhance the accuracy and reliability of their threat detection systems. This blog post will walk you… Continue Reading
EDA Dimensionality Reduction: Find the Best Method for Your Data James Bower, June 25, 2024June 25, 2024 Understanding Non-Linear Dimensionality Non-linear dimensionality reduction is like discovering hidden paths in a complex forest. It reduces the number of dimensions in a dataset while capturing intricate, non-linear relationships among the features. Unlike linear methods that assume straight-line relationships, non-linear methods uncover more intricate patterns, which is crucial in cybersecurity,… Continue Reading
Anomaly Detection Improved Anomaly Detection in Cybersecurity using Model Cascading James Bower, June 9, 2024November 7, 2024 Model cascading in cybersecurity involves using a sequence of machine learning models to detect anomalous behavior in network traffic or user activity. The process starts with an initial general model that flags uncertain or potentially anomalous instances. These flagged instances are then passed to more specialized models that focus on… Continue Reading
Quantitative Security AI-Driven Cyber Security Risk Scoring and Prioritization James Bower, October 25, 2023October 25, 2023 When we think about the security of our systems, a lot of it can be compared to a game of chess. Imagine, for a moment, if the chessboard is our entire digital infrastructure—network, identity, cloud, and SaaS. The myriad of pieces on the board? They’re the numerous components that make… Continue Reading
UEBA Combine UEBA And ML To Prevent Supply Chain Attacks Now James Bower, October 25, 2023October 25, 2023 Could Supply Chain Attacks like Log4J have been prevented? If so, how? Well, that’s what I’m going to dive into today, and also announce the launch of a new project, DependencyCheck.ai. I had this idea a while back that if I combined both ML and UEBA (User Entity Based Analytics),… Continue Reading
Decision Intelligence What is Artificial Decision Intelligence (ADI)? James Bower, October 22, 2023October 22, 2023 What is “Artificial Decision Intelligence?”, and how can it be applied? Artificial Decision Intelligence is made up of the following: Continue Reading
NLP NPUs and the Future of Endpoint Security James Bower, September 23, 2023May 1, 2024 With the news that Intel is in the works to release their first NPU chips in the coming year. I thought it would be interesting to see how this could disrupt how cyber security is handled on the endpoint. For those of you who don’t know, an NPU is a… Continue Reading