Every new cloud service added another telemetry stream. The analytics bill grew each quarter, and so did the queue of alerts nobody had time to read. AI triage was the obvious answer, and the data policy ruled out every hosted option.
What we did
Deployed an open-weight model on the client’s own hardware, at the front of the security data pipeline.
The model classifies, removes duplicates and summarises events before they are stored.
It then triages each alert and adds context from identity, asset and threat intelligence data, so analysts start from a draft, not a raw event.
Guardrails
Inference on premises only. The model host has no internet egress.
Prompts and outputs are logged and reviewable.
A person approves every filtering rule before it can drop data.
Analytics cookies
We use Google Analytics to see which pages people read. No advertising, no selling data. Privacy policy
