网络安全
Kindo 发布深层帽子缝合以剪切不必要的 AI Agent 运行
在 Google 上的首选来源中添加 Unite.AI
AI agent读取每一个安全警报或登录条目，即使其结论是不需要做，也要付出一定的代价。 在企业规模中，这些不平衡的调查可能成为它们自己的大量工作量。 Kindo拥有发布 Deep Hat Sift，这个模型旨在在更大的模型开始处理前决定哪些即将到来的事件值得agent运行。
宣布 October 28,Sift从它服务过的agent的判决中学习，然后过滤agent否则会驳回的事件。 产品从观察而不是扣压开始：每个事件仍然达到agent，直到有人审查拟议的过滤行为并批准一个阈值。
方法推出是一种不同于选择廉价语言模型的成本控制机制。 锡夫特不是降低每次调查的价格，而是为了避免进行不大可能需要采取行动的调查。 其效力取决于这些决定的质量和对被忽略之处的控制。
语言模型前的决定模型
Kindo将Deep Hat Sift描述为一个System One决定模型：一个快速，廉价的模型，它回答一个选择问题而不是生成一个响应。 每个模型被分配到特定的源，目标agent和过滤任务，因此它的学习反映了它打算服务的工作量。
这种特殊性很重要。 与安全调查有关的事件可能与服务台工作流程无关。 以agent的回执作为训练信号。 Kindo 称避免为每条溪流设置单独的人类标签项目。
初始部署以阴影模式运行。 在agent继续检查所有事件的同时，Sift对即将到来的事件进行评分，使系统能够将其预测与agent的决定进行比较。 在开始过滤之前，操作员会收到一个预览，预览他们自己的数据中会扣留哪些内容。
然后，一个人必须批准一个门槛，并提供书面理由。 这就把关于可接受的过滤行为的决定交给了负责工作流程的团队，而不是将激活视为安装模型的自动后果。
取样和失败控制地址
过滤推出是一个难以测量的问题：如果一个事件从未到达agent，团队如何知道它是否应该达到？锡夫特继续随机抽取事件样本，否则会不予采信，让agent对该样本的裁决为正在进行的误差率测量提供参考。
产品页明确了参考点：回顾率和误差率以agent的判断来衡量。 这些衡量标准表明Sift如何密切复制agent的决定。 它们并不独立地确定agent本身是否正确识别了每一个安全事件或操作问题。
类型称如果质量漂移，Sift无法打开，将事件送回agent审查，而不是继续压制。 公司还描述了在猛增期间可以使系统回归影子模式的活动上限。 过滤的事件和批准决定被记录下来，以便各小组能够检查被扣的是什么和为什么。
“在一个人批准门槛之前，它不会过滤任何东西，如果质量漂移，它会打开，并发送一切用于LLM判断，”在公告中，Kindo的一位深层帽子Sift工程师称 Troy Presley。
这些机制暴露了取舍而不是消除取舍。 更保守的过滤可以保留覆盖，同时节省更少的运行。 更积极的过滤可能避免更多的工作，但更加重视取样、漂移探测和下游agent的质量。
为提醒、车票和连续日志流设计
发布针对的是进入量高，需要采取行动的比例低的工作量。 Kindo 名称 SIEM 和端点检测提示，罚单队列，已报告的钓鱼提交，系统和网络日志，以及来自 Kafka 等平台的流。 监测来源包括斯普伦克，数据犬和新遗迹。
锡夫特坐落在agent之前，而不是取代这些源系统。 一个安全平台继续生成检测，一个售票系统继续坚持排队，agent仍然负责到达它的案件。 新层面决定了哪些事件启动了额外的AI工作。
同样的模式也适用于审查交易或政策流的财务和合规工作流程。 在这方面，选择审查事件也不同于提供欺诈侦查或合规认定。 目标agent和周围的业务流程仍然是成果的重要组成部分。
Sift如何适应 Kindo的 Agent 管理平台
Kindo的更广泛的平台将agents与企业系统连接起来，用于安全，基础设施和IT业务。 它将执行与上下文，权限和业务监督相结合，让团队在模式选定后有管理工作的地方。
公司网站描述了agent的所有权，访问政策和agent，所有者和团队的成本归属。 Sift 新增是该工作流程中较早的一点的控制：决定一个事件是否应导致agent运行。 这将技术过滤决定与哪些工作量产生推断费用的业务问题联系起来。
根据发布的公告，深帽子西弗特现在可以到房地、自控云层、Kindo云层和空中环境。 Scoring运行Kindo安装的地方，而模型调用则通过平台进行管理。 该产品与Kindo agents运行。
储蓄取决于流
Kindo没有为Sift提供一般百分比节约或通用精度基准测试。 其产品页则指示团队预览自己事件的预留。 这对买方来说是一个有益的区别：经济结果取决于事件数量、每次避免运行的成本、可诉事件的比例以及团队接受的运营门槛。
对于吵闹的溪流来说，避免不必要的agent跑可以让持续的AI审查更负担得起。 对于遗漏事件产生严重后果的溪流，取样和升级控制变得与推断法案同等重要。 深Hat Sift 带来这些决定进入agent工作流程，中心问题从哪个模型应处理一个事件转移到该模型是否完全需要处理。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Kindo Launches Deep Hat Sift to Cut Unnecessary AI Agent Runs
Add Unite.AI to your preferred sources on Google
An AI agent that reads every security alert or log entry incurs a cost even when its conclusion is that nothing needs doing. At enterprise volumes, those uneventful investigations can become a substantial workload of their own. Kindo has launched Deep Hat Sift, a model designed to decide which incoming events warrant an agent run before the larger model starts processing them.
Announced October 28, Sift learns from the verdicts of the agent it serves, then filters events that the agent would otherwise dismiss. The product starts by observing rather than withholding: every event still reaches the agent until a person reviews the proposed filtering behaviour and approves a threshold.
The approach introduces a different cost-control mechanism from selecting a cheaper language model. Instead of lowering the price of each investigation, Sift aims to avoid investigations that are unlikely to require action. Its effectiveness depends on both the quality of those decisions and the controls around what gets skipped.
A Decision Model Before the Language Model
Kindo describes Deep Hat Sift as a System One decision model: a fast, inexpensive model that answers a selection question rather than generating a response. Each model is assigned to a particular source, target agent and filtering task, so its learning reflects the workload it is intended to serve.
That specificity matters. An event relevant to a security investigation may be irrelevant to a service-desk workflow. Sift learns which events its target agent dismisses, using the agent’s returned verdicts as its training signal. Kindo says this avoids a separate human-labelling project for each stream.
The initial deployment runs in shadow mode. Sift scores incoming events while the agent continues to inspect all of them, allowing the system to compare its predictions with the agent’s decisions. Before filtering begins, operators receive a preview of what would have been withheld on their own data.
A person must then approve a threshold and provide a written reason. This places the decision about acceptable filtering behaviour with the team responsible for the workflow, rather than treating activation as an automatic consequence of installing the model.
Sampling and Fail-Open Controls Address What Gets Missed
Filtering introduces a difficult measurement problem: if an event never reaches the agent, how does the team know whether it should have? Sift continues to send a random sample of events that it would otherwise withhold, allowing the agent’s verdicts on that sample to inform an ongoing miss-rate measurement.
The product page makes the reference point explicit: recall and miss rate are measured against the agent’s judgments. Those metrics indicate how closely Sift reproduces that agent’s decisions. They do not independently establish whether the agent itself correctly identifies every security incident or operational issue.
Kindo says Sift fails open if quality drifts, sending events back through for agent review rather than continuing to suppress them. The company also describes activity ceilings that can return the system to shadow mode during a spike. Filtered events and approval decisions are logged so teams can examine what was withheld and why.
“It filters nothing until a person approves the threshold, and if quality drifts it fails open and sends everything through for LLM judgment,” said Troy Presley, a Deep Hat Sift engineer at Kindo, in the announcement.
These mechanisms expose the trade-off rather than eliminating it. More conservative filtering can preserve coverage while saving fewer runs. More aggressive filtering may avoid more work but places greater importance on sampling, drift detection and the quality of the downstream agent.
Designed for Alerts, Tickets and Continuous Log Streams
The launch targets workloads where incoming volume is high and the proportion requiring action is low. Kindo names SIEM and endpoint-detection alerts, ticket queues, reported-phishing submissions, system and network logs, and streams from platforms such as Kafka. Monitoring sources include Splunk, Datadog and New Relic.
Sift sits ahead of the agent rather than replacing these source systems. A security platform continues to generate detections, a ticketing system continues to hold its queue, and the agent remains responsible for the cases that reach it. The new layer decides which events initiate that additional AI work.
The same pattern could apply to finance and compliance workflows that review transaction or policy streams. Here too, selecting events for review is distinct from providing a fraud-detection or compliance determination. The target agent and the surrounding business process remain important parts of the outcome.
How Sift Fits Into Kindo’s Agent Management Platform
Kindo’s broader platform connects agents with enterprise systems for security, infrastructure and IT operations. It combines execution with context, permissions and operational oversight, giving teams a place to manage the work after a model has been selected.
The company’s website describes agent ownership, access policies and cost attribution by agent, owner and team. Sift adds a control at an earlier point in that workflow: deciding whether an event should cause an agent to run at all. This connects a technical filtering decision with the operational question of which workloads are generating inference costs.
According to the launch announcement, Deep Hat Sift is available now on premises, in a self-managed cloud, in Kindo’s cloud and in air-gapped environments. Scoring runs where Kindo is installed, while model calls are managed through the platform. The product operates with Kindo agents.
The Savings Will Depend on the Stream
Kindo has not supplied a general percentage saving or a universal accuracy benchmark for Sift. Its product page instead directs teams to preview withholding on their own events. That is a useful distinction for buyers: the economic result depends on event volume, the cost of each avoided run, the share of actionable events and the operating threshold the team accepts.
For noisy streams, avoiding unnecessary agent runs could make continuous AI review more affordable. For streams where a missed event has serious consequences, the sampling and escalation controls become just as important as the inference bill. Deep Hat Sift brings those decisions into the agent workflow, with the central question shifting from which model should handle an event to whether that model needs to handle it at all.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.