@uwakwechukwuebukapaul-ai2I've been thinking about a fundamental problem in AI-powered cybersecurity. An AI system shouldn't just tell an analyst what happened. It should show the evide
Building Sentinel DNA: Rethinking AI-Powered Security Investigations
I'm building Sentinel DNA, an AI security investigation platform focused on a problem I believe deserves more attention: turning security alerts into evidence-backed, explainable investigations.
Security teams don't just need another dashboard or an AI chatbot that summarizes alerts. They need systems that can connect evidence, enrich indicators of compromise, reconstruct attack sequences, map activity to MITRE ATT&CK, and explain why an investigation reached a particular conclusion.
That's the direction I'm taking with Sentinel DNA.
My core principles are:
- Evidence before conclusions.
- Explainable AI reasoning, with transparent confidence.
- Traceable evidence and investigation provenance.
- Controlled automation with human accountability.
- Security workflows designed for real-world SOC operations.
I'm currently focused on engineering credibility, security hardening, and independent validation before making bigger claims about readiness.
I'm interested in connecting with AI founders, cybersecurity engineers, security researchers, and people building reliable AI systems for high-stakes environments.
One question for the community:
What's the biggest gap you see in today's AI-powered security operations tools: investigation quality, evidence traceability, analyst trust, or safe automation?
I'd love to hear perspectives from people working on these problems.
Comments4
Evidence over summaries is the right call. Analysts already drown in alerts, and an AI verdict they can't check just adds another thing to second-guess. Showing the chain behind each conclusion is what builds trust.
Absolutely, Miles. Trust comes from being able to verify how a conclusion was reached, not simply being presented with a verdict. That’s the principle behind Sentinel DNA: connecting evidence, investigative reasoning, threat intelligence, and MITRE ATT&CK mapping so analysts can trace the path from an initial alert to the final assessment. AI should reduce the burden of investigation without asking analysts to surrender their judgment. Evidence earns trust. Transparency sustains it.
Analyst trust is the biggest gap of the four you listed, but the SaaS CEOs I work with at SaasRise find a security buyer only pays once that trust turns into a clear result, like hours saved per investigation. So I'd track how much faster a SOC analyst closes an alert with Sentinel DNA and lead your pitch with that.
Absolutely — this is a valuable point. Trust matters, but it becomes commercially meaningful when we can demonstrate measurable operational impact. With Sentinel DNA, I want to measure the difference between a traditional analyst workflow and an evidence-first AI-assisted investigation: time saved per alert, quality of the final verdict, and how easily an analyst can verify the evidence behind it. The goal isn't just to investigate faster; it's to help analysts reach defensible decisions faster without sacrificing accuracy or human oversight. That measurable proof of value is exactly what we're prioritizing as we move toward external analyst validation. Appreciate the perspective.
4 comments
Evidence over summaries is the right call. Analysts already drown in alerts, and an AI verdict they can't check just adds another thing to second-guess. Showing the chain behind each conclusion is what builds trust.
Absolutely, Miles. Trust comes from being able to verify how a conclusion was reached, not simply being presented with a verdict. That’s the principle behind Sentinel DNA: connecting evidence, investigative reasoning, threat intelligence, and MITRE ATT&CK mapping so analysts can trace the path from an initial alert to the final assessment. AI should reduce the burden of investigation without asking analysts to surrender their judgment. Evidence earns trust. Transparency sustains it.
Analyst trust is the biggest gap of the four you listed, but the SaaS CEOs I work with at SaasRise find a security buyer only pays once that trust turns into a clear result, like hours saved per investigation. So I'd track how much faster a SOC analyst closes an alert with Sentinel DNA and lead your pitch with that.
Absolutely — this is a valuable point. Trust matters, but it becomes commercially meaningful when we can demonstrate measurable operational impact. With Sentinel DNA, I want to measure the difference between a traditional analyst workflow and an evidence-first AI-assisted investigation: time saved per alert, quality of the final verdict, and how easily an analyst can verify the evidence behind it. The goal isn't just to investigate faster; it's to help analysts reach defensible decisions faster without sacrificing accuracy or human oversight. That measurable proof of value is exactly what we're prioritizing as we move toward external analyst validation. Appreciate the perspective.