{
  "id": 14950124,
  "title": "AI Decision Models and Their Impact on AI SOC Platforms",
  "url": "https://urgent.news/2026/10/16/ai-decision-models-and-their-impact-on-ai-soc-platforms",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-16T11:30:00.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/ai-decision-models-and-their-impact-on.html"
  },
  "original_language": "en",
  "account": "In just one month, a new category of AI models emerged, gaining widespread attention. TypeSafe AI introduced Jev on September 15, positioning it as a System One model inspired by Kahneman's fast, intuitive thinking. OpenAI followed suit by unveiling its Decisions API at DevDay, with a public beta launched on October 6. Cribl also joined the fray with cribl-decision, an open LoRA adapter for local deployment. These models focus solely on decision-making, receiving a set of state and questions and returning a choice, score, or yes/no with probability attached. For security operations, this development is hailed as some of the best news of the year. However, the focus seems to be misplaced. Three key properties make decision models ideal for alert triage. First, they provide numerical values that can be automated against. Second, they offer typed answers with calibrated probabilities, allowing for threshold-based decisions. Lastly, a model can determine if an alert is benign or likely an incident, with options for escalation or analyst review based on probability thresholds. These models are cost-effective, with Jev priced at $42 per billion input tokens and responses typically taking 70 to 500 milliseconds. Given an enterprise that handles 450,000 alerts annually, the model's annual cost could be around a hundred dollars. This opens up the possibility of prioritizing high-severity alerts, as every verdict becomes a record with a fixed answer space and accompanying probability. Logging each decision and comparing it with actual outcomes facilitates easier auditing. However, a crucial caveat exists: while these models are designed not to hallucinate, meaning their output always matches the defined schema, they can still provide incorrect answers. Thus, the importance of garbage in, garbage out remains. Calibration indicates the likelihood of a model being correct, but the model's knowledge is confined to the specific input characteristics. For instance, if an alert title and severity are provided, the model is calibrated for alerts of that nature. Yet, it has no understanding of external factors like the host. This becomes evident when considering a memory scan of infected endpoints, where most alerts are low severity, and most active infections are already reported as mitigated. A decision model would likely close such alerts with high confidence, as most alerts of this nature are likely benign. Another challenge lies in severity levels. Nearly 1% of real incidents in the data traced back to alerts at the lowest severity levels, amounting to roughly 54 real threats annually. Cribl's model card explicitly highlights the model's tendency to be overconfident and sensitive to prompt and candidate wording. The third crucial aspect involves security context engineering, emphasizing the need to transform alerts into factual information before any decision is made. This includes collecting forensic evidence automatically and incorporating organizational context, which decays rapidly and cannot be purchased or bought off. Security context is dynamic and must be continuously learned and updated. Investing in this aspect involves creating a feedback loop where verdicts are compared with outcomes, ensuring the model's accuracy remains consistent over time.",
  "summary": "In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}