Worked in the space of using ML for security analysis. My experience of it was that it was a race for novel applications for now-standard toolkits. The kinds o

Worked in the space of using ML for security analysis. My experience of it was that it was a race for novel applications for now-standard toolkits. The kinds of problems I encountered require you have an org where you can lose a top shelf researcher/architect for 4-5 months while they train up on new tools and then use them to run down rabbit holes. This requires both vision and direction, and a moonshot culture to support it. Chronicle's focus on their customers' problem in the article is sound, the next step is that each customer, or class of customer is going to be defined by their own specific ROC curve, relative to their business. Some just want raw data, others the world ends over a missed alert (false negative), still others have costs associated with false positives. When you are doing a deterministic rules based system, it's straight forward, but when you get into dynamic and scoring based systems like ML, the responses to it are going to be polarized between customers, and you need top a level vision to tie the whole product narrative together. It's not a thing you stand up that everyone uses, and few people want to buy a framework with a bunch of gigo based trade-offs. Something I discovered in my own work was that the threat model is the business model, both for products and surprisingly for customers as well. I'm really interested in what Chronicle comes up with, as these are truly Hard problems.