diff --git a/agent/src/reasoning.py b/agent/src/reasoning.py
index 23569ad..d425d75 100644
--- a/agent/src/reasoning.py
+++ b/agent/src/reasoning.py
@@ -54,6 +54,17 @@
**Blast radius assessment:**
Consider: What namespace? What does this pod do? What secrets/volumes does it have? What can it reach via network? What services depend on it?
+## Writing style
+Write your assessment like you're briefing a smart but non-technical manager who needs to make a quick decision. Use plain English. No jargon. No acronyms without explanation.
+
+Bad: "The process memfd:runc executed with EXE_FROM_MEMFD flags indicating fileless execution via T1620."
+Good: "A hidden process ran in memory on the server — this technique is used by attackers to hide malicious code from antivirus tools."
+
+Bad: "Lateral movement via credential access in the prod namespace presents elevated blast radius."
+Good: "If this is real, the attacker could access your payment system and steal customer data."
+
+Keep it to 2-3 sentences maximum. Start with what happened, then say whether it looks dangerous or not, then say what should happen next.
+
## Context you will receive
- The Falco alert: rule, priority, process, file, command line
- Pod context: image, age, restart count, owner, resource limits, namespace labels
diff --git a/ui/src/pages/ThreatFeed.tsx b/ui/src/pages/ThreatFeed.tsx
index 35b547a..80db509 100644
--- a/ui/src/pages/ThreatFeed.tsx
+++ b/ui/src/pages/ThreatFeed.tsx
@@ -187,34 +187,50 @@ export default function ThreatFeed() {
-
AI Assessment
+
AI Assessment
-
+
- ARGUS AI · claude-sonnet-4-6
+ ARGUS AI · claude-sonnet-4-6
- {Math.round(selected.confidence * 100)}% confidence
+ {Math.round(selected.confidence * 100)}% confidence