网络安全
Kindo 发布深相帽剪接以剪接不必要的 AI Agent 运行
在 Google 上的首选来源中添加 Unite.AI
AI agent读取每一个安全警报或登录条目，即使其结论是不需要做什么，也会产生成本。 在企业数量中，这些不均衡的调查可能成为其自身的大量工作量。 Kindo拥有发布 Deep Hat Sift，这个模型旨在决定哪些来袭事件值得agent在更大的模型开始处理之前运行。
宣布 October 28,Sift从它所服务的agent的判决中学习，然后过滤agent否则会驳回的事件。 产品起先是观察而不是扣：每个事件仍然会达到agent，直到有人审查拟议的过滤行为并批准一个阈值。
推出方法不同于选择更便宜的语言模型。 锡夫特不是降低每次调查的价格，而是想避免进行不大可能需要采取行动的调查。 其有效性取决于这些决定的质量和对被忽略之处的控制。
语言模型之前的决定模型
Kindo将Deep Hat Sift描述为一个System One决定模型：一个快速，廉价的模型，它回答一个选择问题而不是生成一个响应。 每个模型被分配到特定的源，目标agent和过滤任务，因此其学习反映了它打算服务的工作量。
这种特殊性很重要。 与安全调查有关的事件可能与服务台工作流程无关。 Sift得知目标agent被开除，Kindo 称避免为每条溪流单独设置人类标签项目。
初始部署以阴影模式运行。 在agent继续检查所有事件的同时，Sift对即将到来的事件进行评分，使系统能够将其预测与agent的决定进行比较。 在过滤开始前，操作员会收到一个预览，预览哪些内容会被扣留在自己的数据上。
然后，一个人必须批准一个门槛，并提供书面理由。 这就把关于可接受的过滤行为的决定交给负责工作流程的团队，而不是将激活视为安装模型的自动后果。
取样和失败控制地址
过滤推出是一个困难的测量问题：如果一个事件从未达到 agent，团队如何知道它是否应该达到？锡夫特继续随机抽取事件样本，否则将不予采信，让agent对该样本的判决为正在进行的误差率测量提供参考。
产品页明确了参考点：回顾率和误差率以agent的判断来衡量。 这些衡量标准表明Sift如何密切复制agent的决定。 他们并不独立地确定agent本身是否正确识别出每一个安全事件或操作问题。
类型称如果质量漂移，Sift无法打开，将事件送回agent审查，而不是继续压制。 公司还描述了在一次突起期间可以使系统回归影子模式的活动上限。 被过滤的事件和批准决定被记录下来，这样团队就可以检查什么被扣留以及原因。
称 Troy Presley, Kindo的一位深层帽子剪接工程师，在公告中宣布。
这些机制暴露了取舍而不是消除取舍。 更保守的过滤可以保留覆盖，同时节省较少的运行。 更积极的过滤可能避免更多的工作，但更加重视取样、漂移探测和下游agent的质量。
为提醒、出票和连续日志流所设计
发布针对的是输入量高而需要采取行动的比例低的工作量。 Kindo 名称 SIEM 和端点检测提示，出票队列，被举报的钓鱼提交，系统和网络日志，以及从Kafka等平台流出。 监测来源包括斯普伦克，数据犬和新遗迹。
锡夫特坐落在agent之前，而不是取代这些源系统。 一个安全平台继续产生检测，一个出票系统继续坚持排队，agent仍然负责到达它的案件。 新层面决定了哪些事件启动了额外的AI工作。
同样的模式也适用于审查交易或政策流的财务和合规工作流程。 在此，选择审查事件也不同于提供欺诈检测或合规认定。 目标agent和周围的业务流程仍然是成果的重要组成部分。
Sift 如何适应 Kindo 的 Agent 管理平台
Kindo更广泛的平台将agents与企业系统连接起来，用于安全，基础设施和IT业务。 它将执行与上下文，权限和业务监督相结合，在选取出一个模型后给团队一个工作管理的地方。
公司网站描述了agent的所有权，访问政策和由agent，所有者和团队的成本归属。 Sift 新增 a control at a earlist point at that groups: decide a event 是否应该导致 agent 完全运行。 这把技术过滤决定与哪些工作量产生推断费用的业务问题联系起来。
根据发布的公告，深层帽子西夫特现在可以在自控云层、Kindo云层和被空气淹没的环境中使用。 Scoring运行在Kindo安装的地方，而模型调用则通过平台进行管理。 该产品由Kindo agents公司运营。
储蓄取决于流
Kindo没有为Sift提供一般百分比节约或通用精度基准测试。 其产品页则指示团队预览自己事件的预留。 这对买方来说是一个有益的区别：经济结果取决于事件数量、每次被避免运行的费用、可诉事件的份额以及团队接受的运营门槛。
对于吵闹的溪流，避免不必要的agent跑能使持续的AI审查更能负担得起。 对于漏出的事件有严重后果的溪流，取样和升级控制变得与推断法案同等重要。 深Hat Sift 带来这些决定进入了agent工作流程，中心问题从哪个模型应该处理一个事件转向该模型是否完全需要处理。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Kindo Launches Deep Hat Sift to Cut Unnecessary AI Agent Runs
Add Unite.AI to your preferred sources on Google
An AI agent that reads every security alert or log entry incurs a cost even when its conclusion is that nothing needs doing. At enterprise volumes, those uneventful investigations can become a substantial workload of their own. Kindo has launched Deep Hat Sift, a model designed to decide which incoming events warrant an agent run before the larger model starts processing them.
Announced October 28, Sift learns from the verdicts of the agent it serves, then filters events that the agent would otherwise dismiss. The product starts by observing rather than withholding: every event still reaches the agent until a person reviews the proposed filtering behaviour and approves a threshold.
The approach introduces a different cost-control mechanism from selecting a cheaper language model. Instead of lowering the price of each investigation, Sift aims to avoid investigations that are unlikely to require action. Its effectiveness depends on both the quality of those decisions and the controls around what gets skipped.
A Decision Model Before the Language Model
Kindo describes Deep Hat Sift as a System One decision model: a fast, inexpensive model that answers a selection question rather than generating a response. Each model is assigned to a particular source, target agent and filtering task, so its learning reflects the workload it is intended to serve.
That specificity matters. An event relevant to a security investigation may be irrelevant to a service-desk workflow. Sift learns which events its target agent dismisses, using the agent’s returned verdicts as its training signal. Kindo says this avoids a separate human-labelling project for each stream.
The initial deployment runs in shadow mode. Sift scores incoming events while the agent continues to inspect all of them, allowing the system to compare its predictions with the agent’s decisions. Before filtering begins, operators receive a preview of what would have been withheld on their own data.
A person must then approve a threshold and provide a written reason. This places the decision about acceptable filtering behaviour with the team responsible for the workflow, rather than treating activation as an automatic consequence of installing the model.
Sampling and Fail-Open Controls Address What Gets Missed
Filtering introduces a difficult measurement problem: if an event never reaches the agent, how does the team know whether it should have? Sift continues to send a random sample of events that it would otherwise withhold, allowing the agent’s verdicts on that sample to inform an ongoing miss-rate measurement.
The product page makes the reference point explicit: recall and miss rate are measured against the agent’s judgments. Those metrics indicate how closely Sift reproduces that agent’s decisions. They do not independently establish whether the agent itself correctly identifies every security incident or operational issue.
Kindo says Sift fails open if quality drifts, sending events back through for agent review rather than continuing to suppress them. The company also describes activity ceilings that can return the system to shadow mode during a spike. Filtered events and approval decisions are logged so teams can examine what was withheld and why.
“It filters nothing until a person approves the threshold, and if quality drifts it fails open and sends everything through for LLM judgment,” said Troy Presley, a Deep Hat Sift engineer at Kindo, in the announcement.
These mechanisms expose the trade-off rather than eliminating it. More conservative filtering can preserve coverage while saving fewer runs. More aggressive filtering may avoid more work but places greater importance on sampling, drift detection and the quality of the downstream agent.
Designed for Alerts, Tickets and Continuous Log Streams
The launch targets workloads where incoming volume is high and the proportion requiring action is low. Kindo names SIEM and endpoint-detection alerts, ticket queues, reported-phishing submissions, system and network logs, and streams from platforms such as Kafka. Monitoring sources include Splunk, Datadog and New Relic.
Sift sits ahead of the agent rather than replacing these source systems. A security platform continues to generate detections, a ticketing system continues to hold its queue, and the agent remains responsible for the cases that reach it. The new layer decides which events initiate that additional AI work.
The same pattern could apply to finance and compliance workflows that review transaction or policy streams. Here too, selecting events for review is distinct from providing a fraud-detection or compliance determination. The target agent and the surrounding business process remain important parts of the outcome.
How Sift Fits Into Kindo’s Agent Management Platform
Kindo’s broader platform connects agents with enterprise systems for security, infrastructure and IT operations. It combines execution with context, permissions and operational oversight, giving teams a place to manage the work after a model has been selected.
The company’s website describes agent ownership, access policies and cost attribution by agent, owner and team. Sift adds a control at an earlier point in that workflow: deciding whether an event should cause an agent to run at all. This connects a technical filtering decision with the operational question of which workloads are generating inference costs.
According to the launch announcement, Deep Hat Sift is available now on premises, in a self-managed cloud, in Kindo’s cloud and in air-gapped environments. Scoring runs where Kindo is installed, while model calls are managed through the platform. The product operates with Kindo agents.
The Savings Will Depend on the Stream
Kindo has not supplied a general percentage saving or a universal accuracy benchmark for Sift. Its product page instead directs teams to preview withholding on their own events. That is a useful distinction for buyers: the economic result depends on event volume, the cost of each avoided run, the share of actionable events and the operating threshold the team accepts.
For noisy streams, avoiding unnecessary agent runs could make continuous AI review more affordable. For streams where a missed event has serious consequences, the sampling and escalation controls become just as important as the inference bill. Deep Hat Sift brings those decisions into the agent workflow, with the central question shifting from which model should handle an event to whether that model needs to handle it at all.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.