Skip to content
LARMORLAB

Division

Cyber Division.

We research the path from detection to decision in security operations. The work is at research stage; the results are not yet ready to share.

The division works on the gap between noticing a security signal and reaching a decision. In most organisations that gap is closed by people: alerts pile up, the investigation depends on who is on shift, and the reasoning behind a decision cannot be reconstructed afterwards.

Our research breaks that gap into separate questions. Below we describe which questions we are working on; how we answer them is not something we share at this stage.

Alert volume
A security team sees far more alerts in a day than it can examine. Telling which of them belong to the same event is the first problem.
Traceability
If the finding a decision rests on cannot be shown afterwards, that decision cannot be audited. The investigation itself has to be recorded.
Where autonomy ends
How far such a system should decide on its own and where it must hand over to a person is a question of accountability as much as engineering.
Observed data is not a command
Instructions placed inside an inspected log, email or event record must never be executed. That boundary is a fixed assumption of the research.