The AI Triage Agent That Shows Its Work.
Apara is an explainable, evidence-validated AI SOC triage agent — built to close the gap 450 security leaders say the market hasn't closed yet.
What is APARA?
Apara is an AI SOC triage agent that reads incoming security alerts, judges their severity, and decides whether to close or escalate them, recording the reasoning and evidence behind every decision. It is built for security operations centre teams who want the speed of automation without giving up control of critical incidents, and it proves its accuracy on a customer's own labelled alerts before deployment.
- WHAT IT IS
- An AI SOC triage agent that reads security alerts, judges severity and intent, and decides whether to close or escalate them.
- WHO IT IS FOR
- SOC leads and analysts who need fewer false positives without losing control of critical incidents.
- MEASURED ACCURACY
- 97.8% precision, 80% recall and an F1 score of 0.88 across 1,000+ labelled real SIEM alerts.
- AUTONOMY
- Bounded by severity and confidence; high and critical alerts always stop for a human analyst.
- EVIDENCE
- Every verdict carries a reasoning trace, the evidence used and an override log.
- STARTING POINT
- A free evaluation run on 30 to 100 of your own labelled alerts, with precision and recall at each threshold.
AI adoption in the SOC solved nothing that mattered
450 CISOs and security leaders surveyed by Sapio Research on behalf of Torq (2026) describe an industry that adopted AI everywhere and got more complexity, not more security.
AI tools running per SOC, on average
rely on fragmented, disconnected point tools
cite at least one factor eroding trust in AI
actually use AI for triage — despite 97% believing it can handle it
Source: Torq, "The 2026 AI SOC Leadership Report" (Sapio Research, n=450 CISOs/security leaders)
Three gaps, not one — and no platform closes all three
Confidence vs. Control
Leaders trust AI on every major use case, but won't let it act past medium severity — because no platform lets them calibrate autonomy to actual risk.
Execution vs. Judgment
AI has taken over alert processing; analysts now spend their time validating decisions. That only works if the platform makes judgment fast — most don't.
Adoption vs. Architecture
80% run fragmented point tools and say it creates operational drag. 85% want one unified platform. Adoption outran architecture, industry-wide.
The gap is measurable: usage lags confidence everywhere
Security leaders are already confident AI can handle these functions. Actual usage tells a different story — and the widest gaps sit exactly where the risk of a wrong call is highest.
Source: Torq, "The 2026 AI SOC Leadership Report" (2026)
Two tools that make trust earnable, not assumed
The Apara Platform is built around a simple premise the report validates: leaders don't want more AI, they want AI that shows its work and proves itself before it acts.
Dispatch Console
TRIAGE WITH A VISIBLE CHAIN OF REASONING
- Autonomy dial gated by severity + confidence — low/medium auto-resolves, high/critical always stops for a human
- Reasoning trace on every verdict, not just a score — the #1 trust unlock the report identifies
- Override log captures every analyst disagreement as the seed of a feedback loop
- Manual CSV/JSON upload or live API polling from a real SIEM/EDR feed
Evaluation Harness
PROOF BEFORE TRUST, NOT AFTER
- Bring-your-own labeled dataset — CSV/JSON, same schema the Dispatch Console ingests
- Real precision, recall, F1, and a confusion matrix — not a vendor accuracy claim
- Threshold analysis shows dangerous misses at each confidence cutoff, before you trust it
- Run history persists — shows the agent improving run over run, not a single snapshot
Tested on real SIEM data, not just our own synthetic sets
1000 alerts randomly sampled from actual SIEM exports, spanning endpoint, IDS, cloud, IoT, network, auth, firewall, and AI-system events. Sixty rounds of iterative testing — including catching and fixing two real bugs along the way, not just prompt tweaks.
1 false alarm across 99 scored alerts
Conservative — several remaining misses trace to known test-data artifacts, not agent errors
Stable across consecutive clean runs
After various targeted, verified fixes
One known limitation, disclosed on purpose: the agent occasionally under-weights recently-rotated credentials as a mitigating signal.
What we've actually closed — measured against the report
Adjustable autonomy dial gated by severity + a live confidence threshold — directly answers the 72%-comfortable-at-medium-and-below finding.
Every triage decision shows its reasoning before an analyst has to trust it — the single largest trust unlock the report identifies (46%).
Real ingestion built for one source at a time, proven on labeled data. Not yet the unified, cross-tool view 85% of leaders said they want.
Where we sit — honestly, including where we're behind
"Not yet" items are the roadmap — not gaps we're hiding from a diligence conversation.
| CAPABILITY | LEGACY SOAR | POINT AI TOOLS | APARA PLATFORM |
|---|---|---|---|
| Explainable reasoning per decision | Rare | ||
| Adjustable autonomy by severity/confidence | |||
| Accuracy proven before deployment | |||
| Real SIEM/EDR ingestion (API + manual) | Varies | ||
| Unified reasoning across tools | Not yet | ||
| Closed-loop retraining from overrides | Rare | Not yet |
Prove it on their data before they trust it on their alerts
Free Evaluation Run
Prospect hand-labels 30–100 of their own alerts. Evaluation Harness reports real precision/recall on their data — not a vendor benchmark.
Paid Pilot
Dispatch Console goes live against one real alert source (CSV export or API), autonomy capped at low/medium severity, full human review above that.
Expand
Add alert sources, extend autonomy as the override rate proves out, and layer in the data governance and correlation work the roadmap identifies.
Key terms, in one sentence each
- AI SOC triage
- AI SOC triage is the use of a machine learning or language model agent to judge incoming security alerts, group related ones into incidents, and decide which to close and which to escalate to an analyst.
- Explainable verdict
- An explainable verdict is a triage decision that arrives with the reasoning behind it, the evidence it relied on and the alternative it rejected.
- Autonomy threshold
- An autonomy threshold is the combination of severity and model confidence above which the agent may act alone, and below which a human must decide.
- Evaluation harness
- An evaluation harness is the tool that runs an agent against a labelled set of the customer's own alerts and reports precision, recall, F1 and false negatives at each confidence cutoff.
Sources and further reading
The definitions and comparisons on this site follow established security-operations practice. These are the primary references.
- MITRE ATT&CK — The knowledge base of adversary tactics and techniques that security teams use to describe what a detection is looking at.
- NIST Cybersecurity Framework 2.0 — The governance and risk-management framing most security operations programmes are audited against.
- NIST SP 800-61, Incident Response Recommendations — Computer security incident handling guidance, including detection analysis and triage.
- CISA — Public advisories and detection guidance that security operations centres use day to day.
- Verizon Data Breach Investigations Report — The annual evidence base on how incidents actually start and how patterns repeat year to year.
Common questions about Apara
What does Apara do?
Apara reads each incoming security alert, judges its severity and intent using the surrounding context, and decides whether to close it or escalate it to an analyst with a summary. Every decision arrives with the reasoning and evidence behind it.
How accurate is Apara?
In testing on 1,000+ labelled real SIEM alerts, Apara reported 97.8% precision, 80% recall and an F1 score of 0.88, with severity assigned correctly about 80% of the time. Teams can reproduce those numbers on their own alert sample before deployment.
Can Apara close alerts without a human?
Only low and medium severity alerts can be resolved automatically. High and critical alerts always stop for a human analyst, whatever the model confidence, and the thresholds are adjustable per team.
How do I test Apara on my own data?
Hand-label 30 to 100 of your own alerts and run them through the evaluation harness. It reports precision, recall, F1, a confusion matrix and which threats would be missed at each confidence threshold, before any contract or deployment.
Is Apara a SOAR?
No. Legacy SOAR executes playbooks your team has already written. Apara makes the judgement call about which alerts matter; many teams run it in front of an existing SOAR, which then carries out response playbooks for escalated cases.
Who is Apara for?
SOC leads and analysts in teams where the queue is dominated by repetitive first-pass triage, and where analysts need to defend each closure rather than re-investigate it.