David Wolf · Portfolio Use Case

AI SECURITY · PRODUCT SECURITY · UNUM

UNUM

LLM Attack Story & Detection Engineering

A paid consulting engagement using LLM-assisted attack trees, MITRE ATT&CK mapping, ServiceNow asset inventory, enterprise architecture context, synthetic logs, and Splunk SPL detections.

Delivered a two-month consulting engagement for UNUM that used LLM-assisted attack-tree and attack-story generation, MITRE ATT&CK mapping, ServiceNow asset inventory, data-center and campus architecture context, CISO risk framing, Zero Trust tagging, synthetic log generation, and Splunk SPL detection engineering to create realistic enterprise attack scenarios and testable detection logic.

Client

UNUM

Engagement Type

Paid consulting engagement

Period

2025; two-month engagement

Role

AI Security / Detection Engineering Consultant

Focus Areas

LLM-Assisted Security Engineering, Attack Trees, Attack Stories

The Context

This was a primary paid consulting engagement. The project combined AI-assisted security analysis with enterprise detection engineering, using UNUM-specific infrastructure context, ServiceNow asset inventory, data-center and campus architecture, control group mapping, MITRE ATT&CK alignment, Zero Trust tagging, Splunk SPL query development, and realistic synthetic data/log generation.

The Challenge

The core challenge was converting enterprise-specific architecture and asset context into attack scenarios that were realistic enough to matter, structured enough to map to controls, and concrete enough to become detections. The work needed to avoid generic cyber storytelling and instead produce scenarios tied to actual infrastructure, services, impact paths, controls, telemetry, and SIEM validation.

What I Did

•Used LLM-assisted workflows to generate, iterate, and refine realistic enterprise attack trees and attack stories
•Grounded attack scenarios in UNUM's ServiceNow asset inventory and architecture context rather than generic attack templates
•Incorporated data-center and campus architecture details to ensure the scenarios could plausibly target relevant infrastructure and services
•Mapped attack paths to MITRE ATT&CK tactics, techniques, and enterprise-relevant behavior patterns
•Aligned scenarios to CISO-level enterprise risk, actual impact paths, and control group expectations
•Tagged attack stories with Zero Trust buckets, relevant devices, infrastructure components, control types, and security policy categories
•Translated attack stories into detection engineering requirements and Splunk SPL query logic
•Generated realistic synthetic logs and data to support detection testing without relying on unsafe or unavailable production evidence
•Iterated scenarios and detections so outputs became usable for validation, communication, and security engineering rather than remaining conceptual AI output

The Outcome

Delivered an innovative AI-assisted detection engineering engagement for a major insurance enterprise.

Scenarios

To MITRE ATT&CK and control groups

ServiceNow

Asset inventory and enterprise architecture context

Splunk

SPL queries for detection engineering

Realistic

Synthetic logs and data for testing

Key Deliverables

•LLM-assisted attack-story generation workflow
•Enterprise-specific attack-tree modeling
•ServiceNow asset inventory alignment
•Data-center and campus architecture attack-context modeling
•MITRE ATT&CK mapping
•Control group mapping
•Zero Trust bucket tagging
•Splunk SPL detection queries
•Synthetic log and data generation for testing
•CISO risk and enterprise impact framing

At a Glance

Company: UNUM
Industry: Insurance / Enterprise Security / Detection Engineering
Engagement Type: Paid consulting engagement
Role: AI Security / Detection Engineering Consultant
Period: 2025; two-month engagement
Location: Remote

Focus Areas

•LLM-Assisted Security Engineering
•Attack Trees
•Attack Stories
•MITRE ATT&CK
•ServiceNow Asset Inventory
•Enterprise Architecture Context
•CISO Risk Alignment
•Zero Trust Buckets
•Control Mapping
•Splunk SPL
•Detection Engineering
•Synthetic Logs
•SIEM Validation

Tools & Technologies

•LLMs
•Agentic Workflows
•MITRE ATT&CK
•ServiceNow Asset Inventory
•Splunk
•SPL
•Detection Engineering
•Synthetic Log Generation
•Attack Trees
•Attack Stories
•Zero Trust
•Enterprise Risk
•CISO Risk Framing
•Security Controls
•SIEM
•Infrastructure Security

Public-Safe Caveat

Based on user-provided project context. Intentionally omits sensitive UNUM architecture, ServiceNow asset details, specific services, internal systems, SPL queries, synthetic log schemas, control mappings, and private deliverables.

David Wolf · Portfolio Use CaseAI SECURITY · PRODUCT SECURITY · UNUM

UNUM

LLM Attack Story & Detection Engineering

A paid consulting engagement using LLM-assisted attack trees, MITRE ATT&CK mapping, ServiceNow asset inventory, enterprise architecture context, synthetic logs, and Splunk SPL detections.

Client

UNUM

Engagement Type

Paid consulting engagement

Period

2025; two-month engagement

Role

AI Security / Detection Engineering Consultant

Focus Areas

LLM-Assisted Security Engineering, Attack Trees, Attack Stories

The Context

The Challenge

What I Did

•Used LLM-assisted workflows to generate, iterate, and refine realistic enterprise attack trees and attack stories

•Grounded attack scenarios in UNUM's ServiceNow asset inventory and architecture context rather than generic attack templates

•Incorporated data-center and campus architecture details to ensure the scenarios could plausibly target relevant infrastructure and services

•Mapped attack paths to MITRE ATT&CK tactics, techniques, and enterprise-relevant behavior patterns

•Aligned scenarios to CISO-level enterprise risk, actual impact paths, and control group expectations

•Tagged attack stories with Zero Trust buckets, relevant devices, infrastructure components, control types, and security policy categories

•Translated attack stories into detection engineering requirements and Splunk SPL query logic

•Generated realistic synthetic logs and data to support detection testing without relying on unsafe or unavailable production evidence

•Iterated scenarios and detections so outputs became usable for validation, communication, and security engineering rather than remaining conceptual AI output

The Outcome

Delivered an innovative AI-assisted detection engineering engagement for a major insurance enterprise.

Scenarios

To MITRE ATT&CK and control groups

ServiceNow

Asset inventory and enterprise architecture context

Splunk

SPL queries for detection engineering

Realistic

Synthetic logs and data for testing

Key Deliverables

•LLM-assisted attack-story generation workflow

•Enterprise-specific attack-tree modeling

•ServiceNow asset inventory alignment

•Data-center and campus architecture attack-context modeling

•MITRE ATT&CK mapping

•Control group mapping

•Zero Trust bucket tagging

•Splunk SPL detection queries

•Synthetic log and data generation for testing

•CISO risk and enterprise impact framing

At a Glance

CompanyUNUMIndustryInsurance / Enterprise Security / Detection EngineeringEngagement TypePaid consulting engagementRoleAI Security / Detection Engineering ConsultantPeriod2025; two-month engagementLocationRemote

Focus Areas

•LLM-Assisted Security Engineering

•Attack Trees

•Attack Stories

•MITRE ATT&CK

•ServiceNow Asset Inventory

•Enterprise Architecture Context

•CISO Risk Alignment

•Zero Trust Buckets

•Control Mapping

•Splunk SPL

•Detection Engineering

•Synthetic Logs

•SIEM Validation

Tools & Technologies

•LLMs

•Agentic Workflows

•MITRE ATT&CK

•ServiceNow Asset Inventory

•Splunk

•SPL

•Detection Engineering

•Synthetic Log Generation

•Attack Trees

•Attack Stories

•Zero Trust

•Enterprise Risk

•CISO Risk Framing

•Security Controls

•SIEM

•Infrastructure Security

Public-Safe Caveat

David Wolf

AI Security · Product Security · Security Leadership

davidwolf.com/resumelinkedin.com/in/davidrwolfdavid@aisecurity.llc

Based on analyzed public signals, not proof of any individual's or company's internal state.

LLM Attack Story & Detection Engineering

A paid consulting engagement using LLM-assisted attack trees, MITRE ATT&CK mapping, ServiceNow asset inventory, enterprise architecture context, synthetic logs, and Splunk SPL detections.

The Context

The Challenge

What I Did

•Used LLM-assisted workflows to generate, iterate, and refine realistic enterprise attack trees and attack stories
•Grounded attack scenarios in UNUM's ServiceNow asset inventory and architecture context rather than generic attack templates
•Incorporated data-center and campus architecture details to ensure the scenarios could plausibly target relevant infrastructure and services
•Mapped attack paths to MITRE ATT&CK tactics, techniques, and enterprise-relevant behavior patterns
•Aligned scenarios to CISO-level enterprise risk, actual impact paths, and control group expectations
•Tagged attack stories with Zero Trust buckets, relevant devices, infrastructure components, control types, and security policy categories
•Translated attack stories into detection engineering requirements and Splunk SPL query logic
•Generated realistic synthetic logs and data to support detection testing without relying on unsafe or unavailable production evidence
•Iterated scenarios and detections so outputs became usable for validation, communication, and security engineering rather than remaining conceptual AI output

The Outcome

Delivered an innovative AI-assisted detection engineering engagement for a major insurance enterprise.

Scenarios

To MITRE ATT&CK and control groups

ServiceNow

Asset inventory and enterprise architecture context

Splunk

SPL queries for detection engineering

Realistic

Synthetic logs and data for testing

Key Deliverables

•LLM-assisted attack-story generation workflow
•Enterprise-specific attack-tree modeling
•ServiceNow asset inventory alignment
•Data-center and campus architecture attack-context modeling
•MITRE ATT&CK mapping
•Control group mapping
•Zero Trust bucket tagging
•Splunk SPL detection queries
•Synthetic log and data generation for testing
•CISO risk and enterprise impact framing

LLM Attack Story & Detection Engineering

A paid consulting engagement using LLM-assisted attack trees, MITRE ATT&CK mapping, ServiceNow asset inventory, enterprise architecture context, synthetic logs, and Splunk SPL detections.