An AI SOC analyst takes each new alert through the first steps a human would (enrich the host, user, file and network indicators, check history and related alerts) and writes up the case with a suggested disposition. A human analyst reviews it and decides.
All Cybersecurity & SOC →
Most alert triage follows a script. A suspicious process on an endpoint: who is the user, what else ran on the host, is the hash known, has this fired before, did the parent process make sense. A risky sign-in: is the location usual, was MFA satisfied, is the device managed, what did the session do next. Every analyst runs these lookups in roughly the same order, and most alerts are closed as benign once they have.
An agent can run the script. It queries Splunk, Microsoft Sentinel or Elastic, the EDR, the identity provider and the asset inventory, and writes a case an analyst can read in a minute: what fired, what was checked, what was found, which ATT&CK techniques fit, and what it would do. The analyst confirms, corrects or escalates. Over time the corrections become the test set that the agent must pass before any change ships.
SIEM, EDR or identity
alert text treated as data, never instruction
read-only lookups, logged
evidence, ATT&CK, suggestion
confirm, correct, escalate
critical assets or signs of manipulation
It handles the investigation steps that are the same for every alert of a given type: enrichment, history, related activity and a first assessment, then writes a case note with a suggested disposition. A human analyst reviews the note and makes the call. Done well, it shortens the time to a decision and gives every alert the same baseline investigation, even at three in the morning.
By replaying alerts the team has already resolved and comparing the agent’s suggestion and evidence with the analyst’s conclusion, then by analyst ratings on live cases. The number that matters most is how often it suggested benign for something that was not. That set is kept as a regression test, and any change to prompts, models or tools must pass it.
Not in the systems we build. Even a well-calibrated agent will occasionally mark a real intrusion as benign, and an attacker who learns the pattern can aim for it. Analysts can bulk-confirm cases the agent marked benign with strong evidence, which keeps the speed gain while a person still owns each decision.
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
We start by replaying a month of alerts your team has already closed.
30-minute technical call · no deck