- UX for AI
- Topics
- Advanced Techniques
Advanced Techniques
Human-in-the-Loop in Agentic Investigations: A Snowball Sprint Storyboard Analysis
"Human in the loop" is the most overused phrase in agentic AI. And the human is almost always in the wrong place. The Storyboard is how you figure out where your human should actually sit. Here is the complete Snowball Sprint Analysis of two real agentic SOC investigation flows — side by side, from public material. Same alert. Same human. Order-of-magnitude difference in MTTR.
Amplify, Obfuscate, Simulate: The 3 Legitimate Uses of Synthetic Data in SOC Tooling (Synthetic Users Is Not One of Them)
There's a disturbing trend in security AI: synthetic users replacing real customer research. For an AI MacGyver, synthetic data is duct tape. Brilliant to help amplify rare signals, obfuscate for privacy, and simulate for agent testing. But you don't do brain surgery with duct tape. And you don't replace handshakes with synthetic users. The duct tape is for machines. The handshake is for humans.
Kids & Matches, Agents & Judges, and the Simplest SOC Agent Safety Layer Nobody Built (Yet)
Your judge model doesn't need to be smarter than your agent. It can be a stubborn 5-year-old that tells your agent, "Mom said no matches!"Agentic Judge-in-the-Loop (JITL): why and how to build one. The real conversation.
What SOC Agents Can Learn from Claude-in-Chrome's Growing Pains
The Chrome Web Store is not where you'd expect to find a blueprint for what's broken in agentic security tooling. But it offers an exceptional glimpse into Agentic AI's growing pains. Claude-in-Chrome — built by arguably the most safety-focused AI lab in the world — sits at 2.7 stars. Read enough of the reviews, and you stop seeing a product failing. You start seeing a category failing. The same patterns show up in every SOC agent deployment I've encountered. The browser just makes them impossible to ignore.
Should the Agentic SOAR Playbook Pull the Trigger? The Math Is Simpler Than You Think
OpenClaw Agentic AI attacks are increasing. Yet most SOC teams are keeping the human-in-the-loop action model. In today's AI world, they aren’t being “safe” — they’re choosing slower, more expensive failures.
