Swimlane has added an intelligent routing function that automatically classifies alerts coming into security operations centers (SOC) and splits investigation paths. SiliconANGLE reported on Aug. 19 that the function is designed to send alerts to an appropriate route among deterministic automation, AI-based investigation and agentic automation.

The new function first determines the complexity of an alert and the level of AI intervention required at the initial triage stage. It handles simple tasks with existing automation and applies higher-level AI only to matters requiring reasoning and judgment. Swimlane said this can improve security teams' investigative capabilities without handing all tasks to high-cost AI models.

Cody Cornell (코디 코넬), co-founder and chief executive officer, said that in a situation where AI use is increasing, next-generation SOCs cannot fundamentally assign all tasks to AI. He said that in investigations on the scale of hundreds of thousands of cases, even a cost of $5 to $10 per case can quickly add up. He explained that the goal is to reduce the cost burden by assigning smaller or larger models appropriately for each alert.

Security teams do not have to rely only on the results of automatic classification. Even if an alert is judged to be simple and sent to deterministic automation, it can be sent again to a model with higher reasoning capability if it turns out to be the starting point of a bigger threat. Swimlane said control remains with the security team throughout the process, and that AI is a tool that supports human judgment rather than replacing it.

Swimlane pointed to a problem with existing AI-based security platforms of sending even tasks that can be handled with deterministic scripts to generative AI models. It said using expensive models for tasks that can be done with text searches or a six-line Python script can raise costs by thousands of percent and the results can also vary significantly.