ON 16 October 2026, The Hacker News captured a surge of interest in AI decision models for security operations, spotlighting new “System One” style tools such as Jev from TypeSafe AI, OpenAI’s Decisions API, Cribl’s open LoRA adapter, and several open‑source entrants like Laya. Rather than generating text, these models return a structured verdict—an answer, a score or a yes/no with a probability—making them well suited to alert triage in security operations centres (SOCs).
The piece argues they can automate thresholding: for example, closing benign alerts automatically above 0.97, or escalating those under 0.6 as potential incidents, with high‑stakes actions tied to stricter thresholds. It also notes the economic argument: Jev pricing at $42 per billion input tokens and reported response times of 70–500 milliseconds, which can translate to a relatively low annual cost for large alert volumes, effectively enabling broader use of automated triage.
The article emphasises a forensic, evidence‑driven approach to enable reliable decisions: collecting process trees, memory dumps, detonation results, and other context before a verdict; and recognizing that calibration depends on the input type and environment. It cites data from its AI SOC Report 2026, including 25 million alerts triaged in 2025, 82,000 requiring memory scans, 2,600 machines infected, and 51% of those infections mitigated by EDR.
It also warns that even well‑formed outputs can be wrong if inputs or prompts are mis‑specified, underscoring the need to capture and learn from organisational context, memory, and outcomes to prevent drift. The piece champions a “collect evidence first” philosophy and highlights the importance of logging and auditing decisions for compliance.