New decision-based AI models from TypeSafe AI and OpenAI are shifting the focus of security automation from text generation to probability-based alert classification.
By enabling cost-effective processing of all notifications, these models help identify the estimated 1% of security incidents typically hidden in low-severity noise.
This analysis examines the technical trade-offs, including the dependency on accurate input data and the necessity of forensic context, given that these models lack internal environmental awareness.
How decision models work
Models like TypeSafe AI's Jev and OpenAI's Decisions API, released in the fall of 2026, work differently from familiar text-generating tools. Instead of writing answers, they process data and arrive at specific choices or probabilities.
For security teams, this technology offers three key benefits:
- Automation by numbers: Because the model calculates probabilities, companies can set thresholds. For example, if an alert appears to be harmless with a high degree of certainty, the system can automatically close it. If the probability is low, the alert is forwarded to a human for review.
- Low cost: Processing each alert is now so cost-effective that companies don't have to pick and choose only the incidents that seem serious. They can check everything.
- Speed: Decisions are made quickly, allowing thousands of alerts to be quickly triaged.
The trap of inaccurate data
Despite the speed, there is a risk: the model relies solely on the data it receives. If this data is incorrect or incomplete, the model will arrive at the wrong decision with high confidence. Research shows that about 1% of real security incidents are found in alerts that are initially considered low severity. Therefore, an incorrect initial assessment can let a serious threat go unnoticed.
READ ALSO
Linus Torvalds defends the use of artificial intelligence by Linux developers
Why context is important
A decision model doesn’t automatically know the environment of a particular company, nor what is considered “normal behavior” there. For example, it doesn’t know whether unusual network traffic is due to an upgrade or an attacker.
Effective investigation requires gathering all the necessary data before the model is asked to make a decision. According to an analysis by Intezer for 2025, of the 25 million alerts reviewed, less than 2% ultimately required human intervention, highlighting that technology can handle the large volume of information, as long as the data it receives is accurate and complete.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)