What happened
On Oct 28 Kindo launched Deep Hat Sift, a 'System One' decision model trained on a target agent's own verdicts that decides which incoming events (SIEM/EDR alerts, ticket queues, phishing submissions, logs, Kafka streams) warrant an agent run. It starts in shadow mode, requires a human-approved threshold with a written reason before filtering, samples withheld events to measure miss rate, and fails open if quality drifts; it runs on-prem, self-managed or air-gapped.
Why it matters
Agentic SOC and IT agents that inspect every alert incur compute cost even on non-events, so Sift adds a human-governed pre-filter layer rather than just picking a cheaper model. It targets the cost-and-noise problem of agentic triage with explicit drift/miss-rate controls, which makes it relevant to teams scaling agent investigation workloads.
Applicability
Security operations teams running Kindo agents on high-volume alert/log streams should evaluate it in shadow mode and approve a conservative threshold before enabling filtering.