I just spent 3 hours arguing with an AI about logarithms.

I just spent 3 hours arguing with an AI about logarithms.

Not because the math was hard. Because we were both staring at a risk scoring algorithm where every threat actor in the graph was scoring 100%.

APT29? 100%. Some random script kiddie with 2 TTPs? Also 100%. Very helpful. Very informative.

The root cause? min(1.0, 0.5 + deg * 0.03) — saturates at degree 17. Most actors have degree 17+. So the entire risk model was basically a boolean. You either exist, or you don't. Congratulations, you're all equally terrifying.

Claude (good boy Claude 🥰) and I fixed it with log-scaled seeds and p95 power-law normalisation. Deployed to production across two platforms. Took about 4 minutes of actual coding and 3 hours of me refreshing dashboards going "hmm yes the numbers are different now" while Claude (good boy 😚, here boy, here boy... 🤗 ) sat there pre-warming embedding caches like a very patient, very expensive space heater.

The real test was the similarity endpoint timing out. Turns out, when you compute random walk embeddings + SVD across 160,000 nodes on a cold cache, 180 seconds isn't enough. The fix? Just... do it at startup. Revolutionary engineering.

This is the reality of building ML-powered security tooling. It's not the
algorithms that break you. It's the normalisation. It's always the
normalisation. You'll be lying awake at 2am thinking about percentile anchoring and whether 0.5 is the right gamma exponent and whether your floor value of 0.01 is philosophically defensible.

Claude (goooood booooy, good boy 😁) doesn't sleep. But I'm fairly confident that if it could, it would also be lying awake thinking about the gamma exponent.

We are both very tired and very bored, and the numbers are finally spread
across a distribution instead of clustered at 1.0, like a bar chart of my will to
live.

Ship it/may the prompt be with yowl...

scottg/out🚀