AI Decision Models Automate Alert Triage with Probabilistic Outputs
New AI models provide structured choices for security alerts, enabling automated triage and audit trails for operations teams.
Key points
- TypeSafe AI launched Jev on September 15 as a System One model for fast decisions.
- OpenAI opened its Decisions API public beta on October 6 at DevDay.
- These models output typed choices with probabilities rather than generated text.
Security operations centers are adopting a new class of artificial intelligence models designed specifically for automated decision-making. TypeSafe AI introduced Jev on September 15, while OpenAI launched a public beta for its Decisions API on October 6. These tools aim to streamline alert handling by providing structured outputs instead of open-ended text generation.
These models differ from standard large language models by skipping text generation entirely. Users provide state data and typed questions, receiving back a choice, score, or yes/no answer with an attached probability. This structure allows organizations to set strict thresholds for automation, such as automatically closing alerts deemed benign with high confidence or escalating low-probability results to human analysts for review.
Economic and Audit Benefits
The cost structure of these models makes them viable for processing every alert an enterprise receives. Jev is priced at $42 per billion input tokens, with response times between 70 and 500 milliseconds. For an organization handling 450,000 alerts annually, the total cost could be around one hundred dollars. This low expense removes the financial barrier to processing all alerts rather than only high-severity ones, ensuring comprehensive coverage without significant budget impact.
Vendor Landscape
Beyond TypeSafe and OpenAI, other vendors are entering this space. Cribl published cribl-decision, an open LoRA adapter that can run locally, offering an on-premises option for organizations concerned with data privacy. Laya and others are also integrating these decision-making capabilities into open-source tooling. This rapid expansion suggests that decision-specific AI is becoming a standard component of security infrastructure, moving from a niche experiment to a widely available utility for security teams.
Defender's checklist
Organizations should evaluate their current alert triage processes to identify bottlenecks where probabilistic models could assist. Teams need to determine appropriate confidence thresholds for automated actions versus manual review. It is crucial to remember that while these models cannot hallucinate outside their defined schema, their answers can still be incorrect. Calibration depends on the quality of input data, so garbage in still results in garbage out, regardless of the model's sophistication.
Operational impact
Security leaders should ask how these models change the workflow for junior analysts and what new monitoring is required for automated decisions. Determine who owns the risk when a model incorrectly closes a legitimate alert. Ensure that audit logs capture the model's probability scores and input context for every decision. Communicate with suppliers to understand how their tools integrate these models and whether data leaves the environment. Review internal policies to ensure they account for automated actions based on probabilistic outputs rather than human judgment alone.
What to do and how to stay safe: TypeSafe AI
- Define clear probability thresholds for automated actions versus manual review before deploying these models.
- Audit the quality of data fed into the models, as poor input leads to incorrect decisions.
- Ensure every automated decision is logged with its probability score for future review and accountability.
- Monitor model performance regularly to verify that calibration remains accurate for your specific alert types.
Step-by-step guide: Implementing AI Usage Policies at Work: A Step-by-Step Framework
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the cost of using the Jev model for alert triage?
Jev is priced at $42 per billion input tokens, which can cost an enterprise around one hundred dollars a year for 450,000 alerts.
Can these AI models hallucinate or generate incorrect information?
While they cannot hallucinate outside their defined schema, their well-formed answers can still be factually wrong if the input data is poor.
Which companies have released these decision models?
TypeSafe AI, OpenAI, Cribl, and Laya have all released or announced decision-focused AI models or adapters.
