Kindo Deep Hat Sift filters unnecessary AI agent runs
The new System One decision model learns which events in high-volume alert and log streams require a large language model, starting agent runs only when necessary.
AT A GLANCE
Key points
- Deep Hat Sift became available on October 28.
- The model learns from an agent’s own verdicts in shadow mode.
- Filtering starts only after a person approves the threshold.
- Drift or sudden volume returns the system to open operation.
What is changing?
Kindo made its self-improving Deep Hat Sift decision model available on October 28. The model scores events in security alerts, support tickets and log streams, deciding which ones need review by an agent powered by a large language model. It can run inside customer infrastructure, including air-gapped environments.
Sift begins in shadow mode, sending every event to the agent while learning from the agent’s verdicts. It starts withholding events deemed unnecessary only after a person approves the previewed threshold with a written reason. A random sample still reaches the agent so the miss rate can be measured. Drift or a sudden event spike returns the system to shadow mode.
Kindo says the product can be used with SIEM and EDR alerts, Jira and ServiceNow queues, Splunk and Datadog logs, and Kafka streams. The company does not provide a universal savings rate; it recommends measuring performance against each customer’s own events and agent verdicts.
Explore the original sources
Source date: 28 October 2026.
Published by AI Radar: 29 Oct 2026, 06:00 (Istanbul, UTC+3).
FOLLOW THE TOPIC
Topics and tags
Share your discovery.
Send this story to a friend.
Reader comments
What do you think about this development? Share your experience or question. Comments are published after editorial approval.
Your name/nickname and comment become public if approved. Read: Privacy notice.
Loading comments…