Agent architecture
How Cyberdroid AI Investigation builds a case that people can examine.
AI Investigation, early access
How does an investigation run?
The model plans each question and software runs it as a query. An analyst reviews and accepts the case.
See the methodMethod
Each case starts from a Detection finding or a SIEM alert. The model proposes a next step and what would disprove it.
Software turns each question into a validated query with row, time and cost budgets.
Each result feeds the next question. If the investigation reaches its limits without enough evidence, the case remains incomplete and reports the gap.
A separate critic tests whether the evidence supports the conclusion, and unresolved objections stay on the case.
The case holds the verdict, confidence, rationale, evidence and any disagreement. An analyst reviews and accepts it.
Measures
Evaluation counts right and wrong conclusions, unsupported claims, incomplete cases and reviewer effort.
Limits
Cyberdroid AI Investigation is in early access. A critic without new evidence can repeat an earlier conclusion.
Sources
Related
Products
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
