A Thousand Small Decisions: Rethinking the Agentic SOC with Jev

This is exciting, but there is an architectural problem underneath it.

In a previous article, AI from the Outside, I looked at how AI could be safely integrated into security operations without simply embedding another opaque model inside every security product. The principle was relatively simple: keep control of the orchestration, expose capabilities through well-defined interfaces and apply explicit guardrails around what AI can do.

Yet, security operations processes ultimately need a degree of determinism by definition. We need to know what can happen, understand why it happened and constrain what happens next. A Large Language Model (LLM) is, by design, non-deterministic. Giving one an objective such as “investigate this incident and deal with it” therefore transfers a considerable amount of control to something whose behaviour we cannot completely predict, even where a skill is intended to cement the desired workflow.

There are already plenty of examples outside cyber security of agents enthusiastically achieving an objective in ways their designers did not expect.

That does not mean we should avoid agentic AI. It means we need to think carefully about where the non-determinism sits.

For example, an investigation may have several possible sources of additional context. Identity data, endpoint telemetry, threat intelligence, vulnerability information or business context might all be available through different Retrieval-Augmented Generation (RAG) services.

Rather than retrieve everything, an LLM could decide which source is most likely to be useful.

Rather than:

Unfortunately, traditional LLMs are surprisingly awkward at these small decisions, despite the fact that some form of intelligent reasoning is often necessary because of the ambiguity inherent in human language.

Imagine you wish to make a decision based on the risk of malware intrusion, but one incident ticket reports ‘malicious attachment quarantined’, while the next says ‘suspicious executable was not blocked’.  For a human, it’s obvious that the malware is contained in the first example, but not in the second. In automation it is much harder to rely on normalised markers such as success or failure in simplistic matching – instead I need to derive the meaning to make a decision.

Yet, if you ask a small traditional model to make a simple yes/no judgement consistently, the results can be surprisingly inconsistent, even when repeatedly asked the same question. Often, I struggled to even constrain the response to the words ‘yes’ and ‘no’, let alone achieve the correct answer. Larger models perform better, but invoking a large reasoning model simply to decide which branch of a workflow to follow is slow and wasteful, not to mention typically dependent on external cloud services for performance and scalability.  

We have effectively been using machines optimised to generate language as decision functions because they were the best general-purpose intelligence primitive available.

A new class of AI models is emerging that is designed not to generate language, but to make bounded decisions quickly and consistently. Enter “System One”.

In September, TypeSafe AI introduced Jev, which it describes as the first “System One” model. Rather than generating text, Jev takes some state and a predefined question and returns a typed decision with probabilities. It is designed for classification, routing, scoring and gating rather than conversation.

The important point is not Jev itself. More interesting is the emergence of a new category of models built specifically for bounded decision-making. Within weeks of Jev’s launch, competing approaches began to appear, suggesting this may represent a broader shift rather than a single product innovation. Most recently, Cloudflare announced its own decision models, Clef and Clef-flash, positioning them as high-speed, structured decision engines for agentic workflows. The growing activity suggests the industry is beginning to recognise that not every AI problem requires a large language model. 

These models are designed to operate in hundreds of milliseconds rather than seconds, making them viable for real-time routing and decision-making tasks. 

They are not perfect, and small models still have limitations and some inherent security wrinkles. But, this is developing remarkably quickly and, for security operations, the potential applications are particularly interesting.

The opportunity with these models is not to replace an investigation with one giant AI decision. It is almost the opposite

Imagine being able to make a cheap, fast, probabilistic decision for every stage of an investigation.

Should this event enter this correlation? Which source of context should be queried? Is endpoint enrichment useful? Does this evidence support the current hypothesis? Should we gather more information? Which specialist model should handle the next task? Is the output from an LLM sufficiently supported by the evidence to proceed?
 

These are generally lower-consequence, bounded decisions. If a model incorrectly decides to query an additional source of telemetry, the consequence is very different from an agent incorrectly deciding to disable an account or isolate a production server.

The model can also be constrained to a set of answers defined by the software. It cannot invent a completely new action if, say, the only permitted outcomes are endpoint, identity, network or stop.

Probabilities provide another useful control. A decision at 98% confidence might allow a workflow to continue automatically. One at 65% might cause another source to be queried. An uncertain decision might simply be referred to a human, a step that I believe is fundamental to any AI-powered SOC.  

Anton Chuvakin has recently argued that simply inserting AI into the familiar detect → triage → investigate SOC model risks creating little more than a 2003 SOC with newer technology attached to it. His broader point is that AI should cause us to reconsider the operating model itself, rather than automate each existing box.

System One models add an interesting architectural possibility to that discussion. Rather than replacing the SOC workflow with a large autonomous agent, these models could fundamentally reshape how decisions are made throughout it. The operating model changes not because AI takes control, but because intelligence becomes embedded throughout the process.
 

This points to an alternative architecture. Instead of assigning large portions of an investigation to an autonomous agent, intelligence is distributed throughout the workflow as a series of bounded decisions.

At first glance, this may seem a modest interpretation of the agentic SOC. Rather than replacing existing operational models, it builds on them, using AI to address areas where static rules struggle with ambiguity, context and uncertainty.

In this architecture, AI becomes a decision layer rather than a control layer. Critical workflows remain governed by software-defined policies, established operating procedures and human oversight, while intelligent models help the system adapt to uncertainty, prioritise information and select the most appropriate next action.

The result is a potentially safer path to accelerated AI adoption in cyber defence. Organisations gain the adaptability, speed and scalability associated with modern AI while reducing the operational risks that accompany unconstrained autonomous agents. For organisations operating in highly regulated or disconnected environments, the emergence of small, efficient decision models could make this approach even more attractive.

Perhaps the future agentic SOC will not be defined by a handful of powerful autonomous agents. Perhaps it will be built on thousands of bounded, intelligent decisions working together inside a framework that remains fundamentally under human control.

The most successful agentic SOCs will be those that grant AI the greatest autonomy. But, for most adopters of AI, the most accessible and safe first steps will continue to be where implementers combine intelligent judgement with clear boundaries, governance and human oversight. Having heard from customers who sit across government and national security about their concerns over approval of high risk and high cost unbounded agentic workflows, Jev-like models could offer the cautious a safer journey to realising the benefits of AI.