Artificial Intelligence
Decision models target SOC alert triage
A vendor-authored analysis argued that decision-focused AI models suit security alert triage, while warning that their output still depends on evidence, environment-specific context and how the systems are built.
- TypeSafe AI released Jev on 15 September, OpenAI opened a public beta for Decisions API on 6 October, and Cribl published cribl-decision.
- The article described decision models as systems that skipped text generation and returned a choice, a score or a probability from typed inputs.
- Intezer said its AI SOC Report 2026 covered 25 million alerts in 2025, including 82,000 live memory scans, about 2,600 infected machines and 51% of infected machines already marked mitigated by the EDR.
- Cribl's model card said its model could be overconfident and sensitive to prompt and candidate wording.
- Intezer said its platform investigated more than 25 million alerts in 2025, escalated fewer than 2% to humans, reached 98% verdict accuracy and had a median triage time of under a minute.
The article said decision models had appeared in products from TypeSafe AI, OpenAI and Cribl, and in open-source tooling through Laya. It described them as models that took structured inputs and returned a decision and probability rather than generated text.
The author argued that this made them suitable for alert triage because their outputs could be thresholded, logged and replayed. It also said the models were cheap enough to run on every alert, while Cribl's model card was quoted as warning that a model could still be overconfident and sensitive to wording.
To show that calibration depended on context, the article cited Intezer's report on 25 million alerts and the figures it gave for live memory scans, infected machines and endpoints marked as mitigated. It also said nearly 1% of real incidents in the data came from the lowest severity alerts.
The article then said investigations should gather evidence before deciding, and it credited Filip Stojkovski with the label Security Context Engineering. It described Intezer's Genetic Analysis technology, Endpoint Scanner and Org Brain as parts of that process.
Named in this story
People
- Kahneman
- was cited in the System One comparison
- Filip Stojkovski
- named Security Context Engineering
Companies
- TypeSafe AI
- released Jev on 15 September
- OpenAI
- announced Decisions API and opened a public beta
- Cribl
- published cribl-decision
- Intezer
- authored the piece and described its SOC platform
Products and systems
- Jev
- TypeSafe AI's decision model
- Decisions API
- OpenAI's decision-model API
- cribl-decision
- an open LoRA adapter for local use
- Laya
- appeared in open-source tooling
- Mimikatz
- was listed as a common in-memory family
- Meterpreter
- was listed as a common in-memory family
- Cobalt Strike
- was listed as a common in-memory family
- Genetic Analysis technology
- compared running code in memory with trusted and malicious code
- Endpoint Scanner
- collected live memory evidence on affected machines
- Org Brain
- stored organisational memory for investigations
How the source tells it
The piece read as a vendor-authored, promotional analysis that mixed technical explanation with product claims.
- hype loaded superlatives and an exclamation mark around the supposed impact on SOC work
- vendor boosterism first-person ownership of the data and repeated product claims used to promote the author's platform
- urgency imperative recommendations and sweeping cost claims presented as immediate priorities