Why 13% of Your Sentinel Rules Never Fire
CardinalOps found 13% of SIEM rules never fire. Check thousands of Sentinel detections against Microsoft's own KQL parser — deterministically, not an LLM.
Blog
Enterprise AI, from real work.
What AI costs, when it holds up, where it fails — and how the technology underneath actually works. These articles come out of real project work. Each one is published in English and German.
How We Built KomplAI: Verifiable Compliance AI
How we built KomplAI, a verifiable compliance AI: every legal citation an LLM makes is machine-verified against EUR-Lex before it reaches the report.
NIS2 Incident Reporting in Practice
NIS2 gives you 24 hours to file an early warning — the hard part is detecting the incident that fast. What Article 23 requires, and how to build for it.
Detection Engineering with LLMs
With LLMs, generating a detection query is the easy 20%; the hard 80% is trust. What works is a generate-validate-refine loop that only ships proven queries.
Long Context vs. RAG: Which Do You Need?
Million-token context windows did not kill RAG. The deciding question is not corpus size — it is whether your prompt prefix is identical for every query.
Tool Use and Function Calling Explained
Function calling doesn't let a model run your code — it returns a request your code decides to run. How tool use works, and how to design tools an LLM can use.
Multi-Agent Systems: When One Agent Isn't Enough
Most AI tasks need one good agent, not a multi-agent system. When splitting into several agents genuinely helps — and when it just multiplies failure modes.
Is Your AI System High-Risk? The Article 6(3) Filter
Being in Annex III does not make your AI high-risk. The Article 6(3) filter can rule it out — but profiling blocks it, and the exemption must be registered.
Acceptance Criteria for Non-Deterministic AI
An AI system cannot pass a binary Abnahme. Owe a threshold on a frozen, hashed test set under a fixed protocol — not an output. How to write the Werkvertrag clause.
How to Measure the ROI of an AI Project
Most AI ROI numbers are fiction. How to measure the ROI of an AI project honestly: set the baseline before you build, name the account, and count the review.
The LLM Audit Log Schema for EU AI Act Article 12
Article 12 names no fields for an LLM. A log proves which corpus, model and prompt produced a RAG answer only if it pins the index snapshot. Full JSON schema.
Your Vector Database delete() Didn't Delete
Usually not. A vector database delete() writes a tombstone and the embedding stays on disk until compaction runs. What GDPR Art. 17 deletion really takes.
Why AI Projects Fail
Most AI projects do not fail on technology. They fail on decisions made in the first week — scope, ownership, exceptions — then look like progress for months.
AI and the Works Council
Almost any AI tool your staff use triggers co-determination under § 87 BetrVG, whatever you intended. What a works council agreement has to cover.
AI for Predictive Maintenance
AI for predictive maintenance should start as condition monitoring: real prediction needs dozens of labelled failures, and most plants do not have them.
Preparing Your Data for AI
What it really takes to get your data ready for AI: where company data hides, how to inventory, clean, structure and permission it, and why good enough wins.
Securing LLM Applications
Securing LLM applications: prompt injection, data leakage, insecure output handling and over-privileged agents, plus the playbook to build systems you trust.
On-Premise vs. Cloud AI
On-premise vs. cloud AI: what self-hosted LLMs really involve, the GDPR and data-sovereignty drivers, the honest trade-offs, and when each is right for you.
How to Choose the Right LLM
How to choose the right LLM for a real project: open-source vs. proprietary, cost, latency, data privacy and lock-in. Why the top benchmark is the wrong test.
Build vs. Buy AI
When an off-the-shelf AI tool is enough and when a custom build pays off: the hidden costs of each, plus a clear build-vs-buy framework for mid-sized firms.
AI in Customer Service That Doesn’t Embarrass You
AI in customer service works when the model drafts and a human sends. Ground answers in your real docs, escalate on rules, and measure deflection honestly.
AI and GDPR in Practice
How to build AI on personal data without breaking GDPR: the duties that apply, where projects go wrong, and how to make compliance part of the architecture.
Practical AI Use Cases for Mid-Sized Companies
Concrete AI use cases for mid-sized companies in four buckets: reading documents, answering questions, automating steps, and forecasting. Where to start.
How to Run an AI Pilot
How to run an AI pilot that actually leads somewhere: how to scope it, what to measure, how to timebox it, and how to avoid the pilot that never ends.
On-Premise LLMs: A Practical Hardware Guide
The hardware behind on-premise LLMs: model size, why GPU memory is the real constraint, quantization, example builds, and when on-premise beats cloud.
AI for Document Processing
AI for document processing pays off when the system knows which fields to trust: OCR sets the ceiling, and cross-checks beat what the model claims.
What Does an AI Project Actually Cost?
What an AI project actually costs: the real cost drivers, what you can build at each budget, the hidden running costs, and how to de-risk before you commit.
Monitoring AI in Production: Drift and Maintenance
Uptime and latency stay green while an LLM system quietly gets worse. What to monitor instead, how model drift really shows up, and what maintenance costs.
The EU AI Act, in Plain Terms
The EU AI Act for mid-sized companies: the risk categories, what actually applies to you, the timeline, how it relates to GDPR, and the steps to compliance.
Evaluating LLM Systems
Evaluating LLM systems needs a golden set of real cases with known-good answers, metrics that fit the task, and regression tests — not a vibe check.
LLM Hallucinations: Why They Happen and What Helps
LLM hallucinations happen because a model predicts plausible text and never looks anything up. Here is what that means in practice and what actually helps.
Chunking Strategies for RAG
Structure-aware chunking beats fixed size and semantic splitting for RAG. How to keep tables and headings intact, use overlap, and test on your own documents.
Vector Databases Explained
For most projects, Postgres with pgvector is vector database enough. Here is what a vector database actually does, and when you really need a dedicated one.
Embeddings Explained
An embedding turns text into coordinates: text about the same thing lands nearby. How that powers retrieval and classification, and the traps that break it.
Deploying AI in Enterprise
Deploying AI in enterprise starts with process, data, control, and rollout. Learn how to choose the right use case, govern risk, and move AI into production.
LLM Fine-Tuning Explained
When LLM fine-tuning creates real leverage and when prompting or RAG is enough: data quality, LoRA and QLoRA, evaluation, and shipping it to production.
RAG Pipelines Explained
RAG pipelines retrieve, rank, ground, and answer. Learn how production RAG systems work, where they fail, and how to design them for reliable enterprise use.
What Is an AI Agent?
AI agents perceive, decide, and act — repeatedly and autonomously. How they work, what separates them from chatbots, and when it is worth building one.