Field Notes

At the SOC, phishing tickets were a fixed tax on analyst time — roughly 30 a week, each triaged by hand. Automating the intake pipeline dropped that to under 5, cut the average time-to-verdict from around 30 hours to under a minute, and gave analysts back about 15 hours a week for work that actually needed a human.

The same reflex runs the recipe site listed below: an LLM drafts a dish, a self-hosted image model illustrates it, and a second model checks the photo actually looks like the dish before anything gets near a commit. When the retry logic turned out to be quietly re-running failed attempts every four hours forever, the fix wasn't a bigger budget — it was the same move as the phishing pipeline: find where the loop doesn't know when to stop, and teach it.

Standing up a threat-intelligence platform from scratch — vendor selection, procurement, deployment, and integrating it with over 40 intelligence feeds, up from three — was less about the tool than about making sure it actually got used: documentation, training, and wiring it directly into the ticketing and SIEM systems analysts already lived in.

Same pattern runs the homelab: evaluating, deploying, and actually integrating a growing stack of self-hosted services — a single sign-on layer now sitting in front of a dozen-plus apps, a self-hosted AI gateway routing between local and hosted models depending on what's being asked, an image-generation pipeline with its own QA step. None of it is interesting in isolation; the point is that nothing has to be logged into separately.

Reporting shifted from ticket-volume counts to outcomes leadership could actually act on — what risk got reduced, what got faster, what capacity got freed up. That's the version of a metric that survives contact with a budget conversation.

The habit travels. A homelab AI pipeline's bill crept up without anyone noticing why — the fix wasn't guessing, it was pulling the raw spend ledger straight out of the gateway's own database, breaking it down by call type and time of day, and finding the actual pattern: a handful of stubborn image-generation attempts silently re-running at full cost every four hours. Full writeup →

Threat intelligence, detection, and response only work as one system if they're actually wired together — in practice that meant partnering directly with Physical Security on vendor evaluation, aligning with Engineering on OT-specific intelligence, and running joint incident-response exercises across teams and, in one case, other organizations entirely.

The homelab version: a solar/battery optimizer, an HVAC controller, and a financial-analytics advisor that don't just coexist — they share a data layer and a lightweight signaling protocol, so a decision made by one (pre-cooling the house ahead of a battery-heavy afternoon) is visible to the others instead of being three unrelated scripts pretending to be a system.