Data and model training
Cyberdroid AI learns baselines on the organization's own hardware.
Where learning happens
AI Detection learns normal behavior for each user, host and application from the organization's own telemetry.
How it works
-
Local learning
AI Detection uses approved telemetry to build historical context within the customer’s environment.
-
Local models
AI Investigation uses local model inference by default. Running a model on evidence is distinct from using that evidence to train the model.
-
Optional fallback
An external model route requires an explicit policy defining permitted information and the service involved.
-
Model routing record
The record shows which model answered each request.
Limits
Fallback
Data sent to the fallback leaves the environment, so policy should allow it only for data permitted to leave.
Scope
This page covers the AI layer. SIEM log retention is set per source.
Standards
Naming a clause is not a claim of certification.
ISO
ISO/IEC 42001 Annex A area A.7 covers data for AI systems.
NIST
AI RMF GOVERN 6.1 and 6.2 cover third-party AI risk.
