I spent the better part of a year as an AI skeptic. Twenty-five years in IT and fifteen in security and DFIR had taught me to be wary of anything sold as magic — and that is exactly how AI was being sold. I couldn't find a use for it that survived contact with real work, and I couldn't understand why organisations were dropping it into sensitive environments with no real grasp of what it could and couldn't do, or where their data was actually going.
So I did what I'd do with any unknown system on a network: I pulled it apart on my own terms.
f4n6 is the record of that. Everything here runs on my own hardware, on my own internal network, with nothing leaving my control. Today that means a cluster of four NVIDIA DGX Sparks running open-weight models, and a rotating cast of those models depending on what I'm trying to get done — forensic triage, timeline reconstruction, tool-calling pipelines, OSINT, and the occasional honest dead end. Once you're no longer bound by per-token API costs and your data genuinely stays private, the questions you can afford to ask change completely.
You'll find two kinds of writing here. Field notes are mine: what I'm building, what broke, the benchmark that didn't go the way I expected, the flag I spent twelve hours chasing that turned out to already exist. The Security Feed is curated — advisories, threat briefs and intel I think are worth your attention, attributed and dated, and kept deliberately separate from my own work.
I'm DFIR and OSINT by trade — SANS-trained and GIAC-certified across Security Essentials (GSEC) 401, Network Forensics (GCIA) 503, Advanced Incident Response (GCFA) 508, Cloud Forensics (GCFR) 509 and Malware Reverse-Engineering (GREM) 610, with further SANS training in Advanced Malware Code Analysis (FOR710) and Smartphone Forensics (FOR585). The day job is finding evil and proving it. This site is where I work out how AI actually helps with that — with a human firmly in the loop.
I'm no longer a skeptic. But I'm not a believer either. I'm a practitioner — and this is what the evidence says.
— Jeff Davies