Like most companies building AI based cyber security, recently we have gotten an increasing number of questions about economics or, more precisely, tokenomics.
In this blog I explain the horses for courses of AI for cyber. If you apply the right kind of AI to the particular problem set, you can absolutely accelerate defense cost effectively. This is crucial because otherwise attackers can essentially economically DDoS us all, flooding defenders with intelligent attacks until our budgets are exhausted.
Waymo
If you have ever ridden in a Waymo, you have trusted your life to what is called an encoder only foundation model.
Why might this be? After all, Google owns Gemini, and has their own TPUs. Surely cost alone is not a driver. And yet the component that reacts when a cyclist emerges from behind a parked van is not Gemini.
Waymo recently published a fairly candid account of its architecture, backed by more than two hundred million rider-only miles. They describe a three part architecture. A sensor fusion encoder handles perception, fusing camera, lidar and radar into embeddings fast enough for the car to react. A driving vision language model, built on Gemini, is reserved for rare and semantically strange situations, and it sits off the latency critical path. And the model that actually steers is a small student, distilled down from a much larger teacher precisely so it can run in real time onboard.
The domains of self driving and building a self driving security operation system are actually analogous, even though the suggested approach is radically different than most start-ups peddling AI for your SOC. At the highest level it is as simple as: use the right AI in the right place. Where volume is high and speed is a system property, you want an encoder. Where the situation is flagged by the encoder to be rare and semantically strange, you want a reasoner. For the real time requirements of driving, an architecture of an encoder plus a decoder or generative model is the clear choice. The result is that the LLM reasoning models focus where they are most useful.
Pretraining
Let us take a quick diversion to understand what an encoder model actually is. A self supervised pretrained foundation model for cyber is less exotic than the phrase suggests. Take an encoder only transformer, and feed it very large quantities of security telemetry with no labels whatsoever. The training objective is reconstruction. Mask portions of a sequence, predict what belongs there, repeat until the model has internalized the grammar of a complex enterprise environment: what follows what, at what cadence, in whose company.
That is our LogLM. Built initially with the help of BNY, one of the largest and oldest financial organizations in the world, the LogLM was pretrained across many environments and many telemetry types, which is one reason that it generalizes on arrival. Its output is a high dimensional embedding of behavior over time. We also built classifiers that read those embeddings and produce compound detections, which look in the embedding space for behaviors that are malicious, rather than merely unusual. This compound architecture is a primary reason why our LogLM operates with very low false positives and hence many fewer wasted tokens.
Upstream
The rise of the security data lake, and the demand by large enterprises and others to own their own telemetry, is another driver that has enabled an improvement in the tokenomics of detection and response.
Cribl has made the path programmable and adaptable. Snowflake and Databricks made storage cheap and the data queryable where it lands. Via this architecture, and solutions like the LogLM, detections now sit next to the telemetry, which means detection no longer needs to wait for the data to be shipped somewhere else such as to a traditional SaaS solution.
When users run the LogLM encoder in the datalake or the telemetry stream we have seen that only approximately thirty percent of the volume continues to the SIEM. The remainder stays in cheap storage, still available for retrospective hunting and for the inevitable regulator.
Seventy percent less ingestion is an enormous savings in license costs, and also saves tokens. Whatever reaches the SIEM is not just smaller, it is better.
Downstream
There remains work that has to happen in the SOC. Here is where very expensive generative models may burn thousands of tokens for each hunt, especially for hunts triggered from false positives from inaccurate detections, or even just to document and close events.
Adversaries are scaling in the same direction as defenders, in volume, in novelty, and increasingly with machine intelligence of their own. A SIEM fed a diet of high fidelity detections may still emit more work than a human team can absorb if the attackers continue to boost their attacks, and the residue is the ambiguous, context hungry hunts and investigations that burn an enormous number of tokens for little to no incremental value.
This is where the AI SOC enters, and where Vigil earns its keep. Vigil is open source under Apache 2.0 and descends architecturally from StackStorm, which is a roundabout way of saying it treats investigation as a workflow of agents rather than as a chat window.
At least two properties of Vigil SOC further improve the tokenomics of the Intelligent Defense Platform. First, each agent can use a different model. Enrichment and first pass triage do not require a frontier reasoner. Correlating a week of context across three data sources might. Second, models can be local. An agent invoked ten thousand times a day against a small model running inside your environment costs almost nothing per invocation, and the telemetry never leaves your domain.
Model assignment stops being a purchasing decision and becomes an operating one, adjusted per agent, per category of work, and revisited as environment changes.
Optimization
One benefit of the open source model of Vigil, and the BYOC or on premise deployment model of the LogLM, is that users also own their own learning loop. Since the model chosen for each agent is a parameter, it can be adjusted and optimized. This is crucial because while projects like SOC Bench (socbench.org) help in getting a snapshot of the relative performance of reasoning models for security tasks, mileage may vary. Your environment is different than the benchmark environment, and that adaptation of parameters is something Vigil can help you with, automatically.
Vigil is a token efficient harness that burns in inside your environment, observing which investigative paths resolve cleanly and which escalate, and shifting agents to model assignments accordingly. Categories the small local model handles reliably stop paying frontier prices. Categories where it hesitates get elevated to a more powerful model. The tuning is empirical and continuous, which is a considerable improvement on the traditional method of estimating token spend once during procurement and then discovering the truth down the road as attack volumes and levels of sophistication continue to grow.
You can read much more about the purpose built harness within Vigil in this post from our founding AI engineer, Mayank Kumar: Lessons learned building a harness for cyber security.
Compounding
Traditionally in a SOC, nearly everything is forwarded to the SIEM, which essentially then includes the humans in the confusion of the SIEM. The architecture we are increasingly assisting organizations in adopting puts an encoder in the stream, sends about a third of the volume onward, hands high fidelity actions to a fleet of agents, and delivers to the humans only the material that actually requires judgment. More than eighty percent less work arrives at the team, and that figure improves as the system learns. We are seeing a reduction of over 95% of work in some cases.
Ingestion savings are the visible part. The compounding part is the volume of human attention you stop consuming. By allowing your team's scarce and highly specific understanding to be focused on systems ownership and the most challenging security tasks, the Intelligent Defense Platform saves on tokens, and reduces team burn out as well.
Waymo did not choose an encoder because it was inexpensive. It chose one because it was fast enough to be trusted and general enough to be useful, and it reserved the expensive reasoning for the situations that deserve it. The economics of the AI SOC begin in the same place, upstream, running as a LogLM next to a data lake or data pipeline.
