AI Decision Models Transform Alert Triage in Cybersecurity

Our AI SOC Report 2026 counted 25 million alerts triaged across the vendor's customer base in 2025 — a scale that makes the arrival of decision-only AI models an operational inflection point, not a novelty.

Jev, OpenAI Decisions, cribl-decision: a new model category arrives

In the space of a month this fall, multiple players introduced models that do not generate prose but produce typed choices, scores, or yes/no answers with probabilities. TypeSafe AI released Jev on September 15 and called it a "System One" model. OpenAI announced its Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally, and other tools such as Laya are appearing in open source tooling. These models accept a structured state and a set of typed questions and return a constrained answer that fits a predefined schema.

Why security operations centers should be excited

The source lays out three operational properties that make these decision models a natural fit for alert triage. First, the models return a numeric probability you can automate against: a calibrated answer lets teams set thresholds (for example, automatically close above 0.97, escalate below 0.6, and send the middle band to an analyst). TypeSafe explicitly suggests stricter thresholds for irreversible actions, mapping neatly onto “disable an account” versus “add a comment to the ticket.”

Second, the economics are compelling. Jev is priced at $42 per billion input tokens with response latencies reported between 70 and 500 milliseconds. The source gives a concrete example: for an enterprise with roughly 450,000 alerts a year and a few thousand tokens per alert, the model bill lands at about one hundred dollars a year, effectively removing the cost rationale for triage that ignores low-severity alerts.

Third, every verdict becomes an auditable record. Because the answer space is fixed and the output carries its own probability, decisions can be logged, replayed, and compared with outcomes more easily than free-text model outputs.

Calibration, reality, and the danger of missing facts

Calibration is a statistical property about distributions, and the source stresses its limits. A well-calibrated model that reports 90% confidence means “across inputs that look like this one” the model is right about 90% of the time — but what “this one” contains is crucial. If the input is only an alert title and severity, the model is calibrated only over such limited inputs and knows nothing about the host.

The report gives hard data that illustrates the gap. Of 82,000 alerts that triggered a live memory scan in 2025, about 2,600 machines had an active infection; 51% of those infected machines had already been reported as mitigated by the EDR. At the larger scale, nearly 1% of real incidents traced back to alerts at the lowest severity levels — roughly 54 real threats a year in a 450,000-alert environment, or about one a week. Cribl's model card is blunt: the model can be overconfident and sensitive to how prompts and candidates are worded. The model schema prevents classical “hallucination” of free text, but a well-formed answer can still be wrong because the input lacked critical facts.

Security Context Engineering and a forensic-first pipeline

Filip Stojkovski framed the necessary upstream work as "Security Context Engineering" — the task of turning an alert into a set of facts before any automated decision. The source describes a forensic-first pipeline built around three kinds of evidence.

• Code-level evidence: Genetic Analysis compares binary code running in memory against a database of trusted and malicious code, catching known malware and reused code fragments.
• Live memory forensics, triggered automatically: an Endpoint Scanner (a single executable with nothing to install) collects process trees, executables loaded into memory, memory dumps where injection is suspected, and files behind scheduled tasks and autoruns — which is how the platform found infected machines marked as “mitigated.”
• Detonation and network forensics: suspicious files are executed in sandbox detonation, and URLs, domains, and IPs are investigated to ground verdicts in observed behavior.

Organizational memory — the product described as Org Brain — stores procedural norms (how the team investigates) and declarative facts (assets, users, normal behavior, SIEM schema). It learns from case history, fetches live context mid-investigation, and writes conclusions back after every investigation. In 2025 the platform investigated over 25 million alerts, escalated fewer than 2% to humans, reported 98% verdict accuracy, and achieved a median triage time under a minute.

What this means for technologists, procurement leaders, and defenders

• Technologists and security teams: invest engineering effort in evidence collection and live context — process trees, memory contents, detonation results — before putting a decision model at the end of the pipeline.
• Procurement and operations leaders: the low token cost of models like Jev changes the calculus on what gets investigated; pricing no longer justifies skipping low-severity alerts, so plan for broader coverage and continuous organizational memory maintenance.
• Incident responders and defenders: measure model calibration inside your environment by tying every automated verdict to its outcome, and watch for calibration drift as assets and behaviors change.

Decision models make the last step — mapping evidence to a verdict — fast, cheap and auditable. But the facts show that speed and cheapness only matter if the input contains the right evidence and the organization keeps its context current. The clear prescription in the source is pragmatic: collect the evidence first, treat organizational knowledge as a living system, then let decision models apply calibrated probabilities against a foundation that can justify — and be audited for — every automated close or escalation.

https://thehackernews.com/2026/10/ai-decision-models-and-their-impact-on.html