Kindo, an AI agent management platform, has launched Deep Hat Sift, a self-improving model that decides which events in high-volume alerts, tickets, and logs need a large language model (LLM) and skips the rest. The company says this lets enterprises run AI agents on their busiest data streams without paying to analyse every event. Sift learns from the verdicts of the agent it serves. It first runs in shadow mode, and begins filtering only after a person approves a threshold with a written reason. A random sample of withheld events still goes through, so the miss rate is always measured. Deep Hat Sift is available now. It runs on premise, in self-managed cloud, in Kindo's cloud, or air-gapped. "It filters nothing until a person approves the threshold," said Troy Presley, Deep Hat Sift engineer at Kindo.

Kindo introduces Deep Hat Sift, a self-improving AI model that gets smarter with every decision to reduce LLM costs. October 28, 2026 New System One decision model learns which events need an LLM and skips the rest, so AI agents can work the busiest data streams without paying to analyze every event. Kindo, the run-anywhere AI agent management platform that puts AI to work and keeps the enterprise in control, today announced Deep Hat Sift, a self-improving AI model that decides which events in high-volume alerts, tickets, and logs need a large language model and skips the rest. Until now, enterprises faced a costly choice: pay for an LLM to review every event, or keep AI agents off their busiest sources altogether. Deep Hat Sift removes that trade-off. Agents run only where there is work to do, and every skipped event is one an LLM never has to process. Deep Hat Sift is a System One decision model, the fast, inexpensive class of AI that answers yes or no rather than generating text. Cheap filters have always existed; the problem is trusting what they skip. Fixed-weight models are only as good as the day they shipped and must be retrained and re-released to improve. Sift learns from the verdicts of the agent it serves, so with every decision it gets better at judging what that agent would have found, and skipping an event becomes a decision an operations team can stand behind. A person sets each threshold once, and every filtered event is recorded for transparency and compliance. "Enterprises are scrambling to rein in runaway LLM costs because they've been locked into an unfair binary choice. Either run a large model on everything and sacrifice speed and cost control, or run a simple, fixed-weight model and accept that you cannot trust what it ignores," said Ron Williams, CEO of Kindo. "Deep Hat Sift gives IT, Security, Finance, and Compliance teams a new world of choice to put intelligent agents to work where cost once made it impossible." Agents that triage events are already among the first to reach production, but the economics break on high-volume sources. Reviewing every event at the volumes a SIEM, log platform, or busy ticketing system produces gets expensive fast. To control costs, many enterprises have kept agents away from their busiest sources, which is where the high-value work often is. That trade-off blocks essential innovation and process optimization. That is the gap Sift closes. It runs first in shadow mode, scoring every event while still sending every event to the agent, and learning from the agent's verdicts which events it dismisses. Those verdicts are the only training data Sift needs, so there is no labeling project for the team to run and no retrained vendor model to wait for. It then previews, on the customer's own events, what it would filter, and begins filtering only after a person approves a threshold with a written reason. A random sample of events that would have been withheld continues to go through, so the miss rate is always measured. Deep Hat Sift is a purpose-built model, assigned to a data source, a target agent, and a filtering task to deliver the best possible performance outcome. A large enterprise can run hundreds of thousands of Sift models at once, each becoming the expert on its own stream and providing significant savings. It works in front of the sources engineers already triage: SIEM and EDR alerts, ticket and alert queues, system and network logs, monitoring tools such as New Relic, Splunk, and Datadog, and streaming systems such as Kafka. Lead use cases include alert storms, alert and ticket triage, log streams, and reported-phishing triage, with real-time review of event streams for policy anomalies and fraudindicators for Compliance and Finance teams. Deep Hat Sift runs entirely inside the customer's environment, including air-gapped, for defense and regulated industries. Deep Hat Sift joins the Deep Hat family, Kindo's models and add-ons for running the LLMs and agents an organization needs affordably and under its own control. Deep Hat Attack opens a door that has largely been closed. General-purpose AI lab models have either held back authorized offensive security testing or offered it only at unaffordable rates. Deep Hat Attack gives security teams a model built for that work, with a human in the loop, so they can test at a depth and scale they can now afford. The release arrives as Finance and IT leaders face growing pressure to justify the cost of running agents. Gartner(R) predicts that "by 2028, an average global Fortune 500 enterprise will have over 150,000 agents in use, up from less than 15 in 2025, generating significant agent sprawl, IT complexity and management challenges."[1] Deep Hat Sift adds a cost and performance lever the category has lacked: LLM use avoidance, not using the LLM at all when the event does not warrant it. It is also a reliability lever. Gartner's September 2026 research on guardian agents states that "if an LLM-based agent makes 10 different calls (for planning, tool use, etc.) and each step has a minor 10% error rate, the agent will complete the overall task successfully only about a third of the time." Gartner also states that "guardian agents use deterministic rules and resource-efficient technologies such as small language models (SLMs) to process low- to medium-ambiguity tasks, escalating only complex anomalies to human supervisors."[2] Kindo built Deep Hat Sift to be that trusted filtering layer, sending only necessary events to LLMs. "We built Deep Hat Sift so an operations team can trust it with the decision to skip something," said Troy Presley, Deep Hat Sift engineer at Kindo. "It filters nothing until a person approves the threshold, and if quality drifts it fails open and sends everything through for LLM judgment." Availability. Deep Hat Sift is available now and runs on premise, in self-managed cloud, in Kindo's cloud, or air-gapped. Scoring runs where the customer installs Kindo, and Deep Hat Sift holds no model-provider or data keys. Deep Hat Sift runs on the Kindo enterprise AI control center platform. Documentation is available at https://www.kindo.ai/platform/ai-alert-triage, and organizations can request a demo at https://www.kindo.ai/get-demo. [2] Gartner, Inc.,Use Guardian Agents to Govern Autonomous AI Systems, Sarah Davies, Dan Wilson, Meghan Hollis, Daryl Plummer, Remi Gulzar and Lauren Kornutick, September 14, 2026. [GARTNER is a trademark of Gartner, Inc. and/or its affiliates. Gartner does not endorse any vendor, product, or service depicted in its research publications. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact.] DRJ HOT ITEMS BC/DR rules & regulations. BC glossary. Webinar Spotlight