How does a detector earn an alert?
Cyberdroid AI Detection runs 21 ML detectors. Each one is proven on your own data, in shadow, before it can raise a single alert.
See the methodMethod
Every detector is disabled, shadow or production. Only production detectors raise alerts.
Shadow findings go to a separate channel, so a new detector is measured without reaching your queue.
Replay tooling measures precision, recall, stability and volume before promotion.
Promotion and rollback are recorded, so every change in what alerts has a history.
Emergency caps per detector and per tenant route overflow to shadow instead of your queue.
Measures
Precision, recall, stability and volume on replay of your telemetry. These decide promotion. We publish the method, not a score.
Limits
Staging cannot anticipate behavior your telemetry has not shown yet. A detector proven on replay is measured, not guaranteed.
