Security teams now hear two kinds of AI pitched for detection: fast models that answer a question in milliseconds, and reasoning models that investigate for minutes. They are different tools for different jobs. This page explains the split, why it matters at telemetry volume, and where each fits in a SOC. This page is the canonical reference.
The short answer
Daniel Kahneman described two modes of thinking: System 1 is fast and automatic, System 2 is slow and deliberate. AI systems that run in production increasingly follow the same split. A System One model reacts quickly to a stream of native signals. A reasoning model (System 2) handles the rare cases that need judgment and explanation.
For detection, volume is a fundamental problem. A large enterprise can emit a billion flow records a day. Only a System One model can look at all of it. A reasoning model can then look into events that the System One model escalates.
Where the pattern already works
Waymo. A pretrained sensor fusion encoder combines camera, lidar and radar over time and produces embeddings for fast reactions. A driving vision-language model handles complex semantic reasoning and is held in reserve for situations that tolerate more latency.
Stripe. A self-supervised payments foundation model, trained on tens of billions of transactions, turns each charge into one embedding. Classifiers read sequences of those embeddings to spot attacks. Stripe reports card-testing detection on large users rising from 59% to 97%, in under 100 milliseconds.
Same shape both times: an encoder over native signal, small classifiers on its embeddings, and a reasoning model downstream for the hard, slow, rare cases.
Two meanings of "System One" in security
The term now covers two designs, and they are easy to confuse.
Encoder foundation models. Bidirectional attention over native tokens, self-supervised pretraining on unlabeled domain data, and a vector as output. Purpose-built classifiers sit on top. A LogLM is this kind of model, trained on security telemetry.
Typed-answer models. TypeSafe AI's Jev, announced in September 2026, is described by its makers as a System One model. You send serialized program state plus typed questions and get calibrated answers back in one parallel pass, in roughly 70 to 500 milliseconds. Someone decides what goes into the state and which question to ask.
Both are fast. They differ in what they already know. An encoder arrives fluent in its domain's data. A typed-answer model arrives fluent in answering calibrated questions about whatever you give it.
How they compare
Encoder (LogLM)
- Job: Score every sequence of telemetry
- Input: Native telemetry tokens
- Output: Embedding plus MITRE-mapped finding
- Speed: Streaming, sub-second
- Where it runs: On premises, air-gapped, or your cloud
- Best fit in a SOC: Detection at full volume
Typed-answer model (Jev)
- Job: Answer typed questions about supplied state
- Input: Serialized state plus questions
- Output: Calibrated probabilities
- Speed: 70 to 500 ms per call
- Where it runs: Hosted API or open source alternative
- Best fit in a SOC: Triage, routing, parser selection, response gating
Reasoning LLM
- Job: Investigate, hunt, explain
- Input: Text and tool output
- Output: Prose and actions
- Speed: Seconds to minutes per decision
- Where it runs: Usually an external API, or your own
- Best fit in a SOC: Escalated cases and hunts
Why detection needs its own System One
Attacks live in sequences. A beacon cadence, a credential used from a host that never touched that service, a slow exfiltration spread over a week of DNS. A per-record question carries that context only if someone packages it first, and packaging it is the detection.
Telemetry is the hard case for general models. IP addresses, ports, hashes, timestamps and counts are exactly the hex, numeric and counting content that general models handle least well. An encoder trained on telemetry with a tokenizer that preserves those structures does not shred them into subwords.
The economics. Per-token pricing multiplies with volume. An open-source project that packs about 1,800 tokens per flow into Jev requests works out to roughly $74 per million verdicts. At a billion flow records a day, that is about $74,000 a day, before identity, endpoint, DNS and cloud logs. An encoder runs on fixed compute inside your environment.
Data residency. Many teams will not send telemetry to a hosted API. Encoders can run on premises or air-gapped.
Open alternatives. Jev itself is a hosted API with no published weights, but its launch spawned open-source decision models you can run locally, such as Laya, Von, Kev and OpenJev. They are built on general-purpose language-model backbones and range from under 100 million parameters to tens of billions; the more accurate ones sit in the hundreds of millions to single-digit billions, and the largest builds reach roughly 26 to 35 billion. A telemetry encoder built for one domain does not need that footprint: DeepTempo's FAQ says LogLM runs on infrastructure you already operate, and many deployments need no GPU. Bigger models cost more to run and need more hardware, which limits where they can be deployed.
Evidence so far. The open models are credible for general decisions (Kev publishes held-out results, including where it loses to Jev), but security evidence is early and mostly from the model authors. Two independent results point the same way. Torq tested Jev zero-shot on real alert triage and measured about 21% accuracy and 3.7% malicious F1, against about 80% accuracy and 71% malicious F1 for its own fine-tuned encoder (https://torq.io/blog/jev-security-alert-triage/). And SecJev, a security-specialized family built on Kev, found that its 0.8B model beat the general 9B Kev model by 20.5 points of task-macro accuracy across 14 security tasks (https://arxiv.org/abs/2610.03073). In both cases, training on the domain beat a larger general model.
Where reasoning models and typed-answer models belong
Downstream of detection. Triage, case routing, parser selection, guardrails on agent actions and response gating all consume detections and support the analyst. Reasoning models then investigate the escalations: hunt, write and test detection logic, explain themselves.
Any of these outputs still needs a harness. A model returns a probability; someone has to decide what 0.72 means at three in the morning. Thresholds, approvals, escalation, audit and rollback belong to the harness, with people in the loop for consequential actions. Vigil is DeepTempo's open-source example of one.
How a LogLM does the System One job
A LogLM is pretrained on unlabeled security telemetry by hiding part of each sequence and learning to reconstruct it from context on both sides. No labels, no rules. To succeed, it learns which tokens travel together, which orderings recur, and which rhythms are ordinary. Typical behavior fills dense regions of the embedding space; a novel sequence lands somewhere sparse.
Classifiers on those embeddings then ask whether the unusual behavior also resembles known attacks, mapped to MITRE ATT&CK. Unusual alone is not an incident. This is how DeepTempo reports 99.3% malicious recall at Deutsche Telekom (Phase II) and a 99 F1 at 0.08% false positives zero-shot with a very large internet service provider.
A practical stack
System One at the stream: an encoder scores every sequence.
Classifiers on embeddings produce MITRE-mapped findings as structured JSON.
Typed-answer models handle downstream routing and gating where a fast calibrated answer helps.
Reasoning models investigate the escalations inside a governed harness.
