When the labels come from an LLM
Research notes from my thesis: why LLM-produced analyst verdicts stop working as independent labels, a weak-supervision approach to WAF alert triage, and three design lessons from the lab. October 2026.
Martin Monzon
Security teams now ask language models to judge alerts. Those judgments become the labels for the next model. I study what this does to the ground truth, and how to triage alerts when the labels cannot be trusted.
Engineer in security operations for regulated financial clients. Asunción, Paraguay.
Writing
Work
WAF alert triage without trusted labels
Weak supervision to prioritize web application firewall alerts when no reliable human labels exist. Lab with Nginx, ModSecurity and the OWASP Core Rule Set in detection mode, a triage model behind a release, block or quarantine proxy, and a Wazuh SIEM with a baseline dashboard and a model-prioritized dashboard. A paper for CLEI is planned.
GradRAG
Helps PhD applicants find advisors whose research matches their interests, by meaning instead of keywords, over more than 30,000 faculty profiles. I built the scraping module that collects the profiles and the pipeline that loads them into the Qdrant vector database. Project led by Erik Wasmosy.
Zeer
An early-stage security startup with engineers from Taiwan and Paraguay. We are building an intelligent SOC in which custom agents help analysts triage incidents, while the analysts make the decisions.
Background
Licenciatura in Informática from Universidad Católica “Nuestra Señora de la Asunción”, where I am completing the engineering degree. I was a teaching assistant there for C programming and Software Engineering. Before security operations, I built and defended web applications as a freelancer. Red Hat Certified System Administrator.