Illustrative 30-day evaluation scenario · cyber

AI triages a security alert and records the escalation path

Buyer roles: CISO, SOC manager, incident commander
Workflow: AI-assisted alert triage with reviewable evidence and disposition

Receipt moments

Alert cluster
correlation inputs
recommendation
reviewer disposition
post-incident audit

Acceptance tests

Analyst can inspect the signals behind the recommendation.
Disposition and reviewer are recorded.
Historical review can reconstruct what was known at triage time.

Evidence artifacts

Alert-to-evidence graph
Disposition register
Post-incident receipt sample

Scope before data access

Name one workflow and operational owner.
Name the reviewer and decision date.
Select synthetic/public, private, or on-premises boundary.
Document excluded data and prohibited uses.

Decision gate: The security owner decides whether reviewability improved enough to expand to another alert class.

Illustrative evaluation design. Not customer evidence, a deployment claim, a certification, legal advice, or a performance promise. Commercial and security terms require written approval.