Security decisions that fit Jev

The author says he is currently working through most of them, mostly incident response, plus some threat hunting. Nothing is described as deployed, and no precision, recall or false-positive rate is given for any listed workflow - the entry's caveat calls it an opinion thread from a practitioner rather than a measured comparison.

Not the way the headline reads. The forget-ChatGPT-and-Claude line is scoped to purely engineering work, where you define the question and the allowed outputs. Open-ended investigation, where you do not yet know what to ask, is the part that still needs a generative model.

It is a proposed example, not an outcome. Bucketing process executions into expected admin activity, software execution, suspicious usage or unknown is a plausible classification task, but the thread publishes no confusion matrix, no sample size and no false-positive rate behind it.

From the vendor, not the author. The line about being 200x faster and cheaper restates TypeSafe's launch numbers of 20-200x faster and 40-400x cheaper; the thread adds no measurement of its own. If alert volume is your bottleneck, benchmark your own pipelines before redesigning triage around it.

Kostas, posting as @Kostastsale, who says he likes building things that solve real problems across cybersecurity, product and research, and lists Greece and Canada. So this is a practitioner's framing of where a decision model fits, not a vendor announcement.

Three buckets. Threat hunting covers ranking hunt results, scoring entities by suspiciousness, and classifying noisy activity at scale. Detection engineering covers false-positive analysis, context-aware scoring over deterministic detections, and validating whether an alert supports the behavior a rule claims. Incident response covers timeline reduction, continuous host and user scoring, and scoping decisions.

A decision engine sitting inside the security workflow. That framing keeps the model as a component returning typed probabilities to existing tooling rather than a chatbot investigating on its own. The x200 claim attached to it is a restatement of the vendor's launch numbers, not his own measurement.