Fast AI Decision Models Could Change How Security Alerts Get Triaged

In about a month, a new type of AI model has gone from nonexistent to widespread. TypeSafe AI released Jev on September 15, OpenAI opened a public beta of its Decisions API on October 6, and Cribl published an open adapter called cribl-decision that can be run locally. These models do not generate text. They are given some information and a set of typed questions, and they return a choice, a score, or a yes/no answer with a probability attached.

The article's author sees this as strong news for security operations, because the models suit alert triage. A probability can be used to set thresholds: close an alert automatically above 0.97, escalate it below 0.6, and send anything in between to an analyst. Costs are low, with Jev priced at $42 per billion input tokens and responses in 70 to 500 milliseconds. For an enterprise with 450,000 alerts a year, the model bill is estimated at around a hundred dollars annually. Every verdict is also logged in a fixed format, which makes it easier to audit and compare with what actually happened.

There is a caveat. When vendors say these models cannot hallucinate, they mean the output always matches the defined format. A well-formed answer can still be wrong, and the old rule of garbage in, garbage out still applies.