Most of the industry asks which model is best; we ask which decision needs what model

Bright curved horizon of a planet glowing against the dark backdrop of space.

The smartest AI choice we ever made with was to use smaller AI. Let me tell you what I mean...

From the first line of code, Aura (the internal name for our engine) was built on a simple conviction: an investigation is not one big question for one big model. It is a chain of decisions, and each decision deserves exactly the intelligence it needs.

Most of the industry asks which model is best. We ask which decision needs what model.

That question shaped every layer of the engine, and today it pays off in a way that is hard to believe until you see it. Nearly 90% of the work behind an Aura verdict runs on small, fast models. Verdicts land about 2.5× faster than our previous generation, at a fraction of the cost. And accuracy held the whole way: over 98% of Aura's verdicts stand unchanged all the way to case close, while the volume Aura handles has grown nearly tenfold.

Designed as decisions from day one

The easy path in AI security is to hand a frontier model the whole case and let it reason. It demos beautifully. At production scale it is slow, expensive and hard to govern, because when the only thing you can measure is the final answer, every improvement is a guess.

We took the harder path from the start. Aura's investigation engine was built as a chain of distinct decisions, each with a clear contract: what it reads, what it must produce, and how its output is checked. Every decision is recorded in production. Every decision can be replayed on its own. Every decision can run on its own model.

That architecture was the plan long before small models were ready to use it. It let us adopt each new frontier model one decision at a time, with evidence instead of hope. And when small models became capable enough, we already knew exactly where they could take over, and had the machinery to show it.

The engine: an investigation as a set of decisions

Every Aura verdict runs through a chain of focused decisions, each with a strict contract and its own model.

Signal Extraction turns raw evidence into facts. Questions are answered against that evidence, every answer citing the events it rests on. The answers become findings: typed statements with a disposition, a confidence and a weight, each traced to its evidence. Gaps in what the telemetry could see are made explicit, not glossed over.

The crucial design choice is the last one: the verdict reasons over findings, not raw logs. It never sees a 100,000-token pile of events, only a short, structured case it can weigh. Because every decision has a contract, each one can be checked, measured and given its own model independently. That is what makes everything that follows possible.

The Lab: where every change is earned

The engine tells us what each decision does. The Lab tells us what happens if we change it. It is the single biggest driver of everything in this article.

Every production investigation is recorded decision by decision: the exact evidence, inputs, outputs, model and timing. The Lab turns that record into a living test bench of hundreds of thousands of real investigations. Any decision can be replayed with a different model, a different prompt or different knowledge, on exactly the same evidence, and compared against what expert analysts concluded.

What makes it a strategic weapon is how it is driven. The Lab is wired to our own AI agents through an internal MCP connection, so engineers and agents alike can design an experiment, run it across thousands of real cases in parallel and judge the outcome against ground truth, in hours rather than weeks. Use of the Lab has grown roughly fortyfold in under a year, because once a team can test at that scale, it stops guessing.

In practice that means:

Every new frontier model is benchmarked on our real investigations the moment it is available, decision by decision, before we commit to it.
Every decision is a candidate for a smaller model. We move one, replay it at scale, and know with evidence whether it holds.
Every new case type is proven before it earns autonomy. Aura closes a new kind of case on its own only after the Lab shows it can.

Most teams evaluate models. We evaluate decisions, on reality, at scale. That is why the rest of this story was possible.

Following the tokens

Because every decision is measured on its own, we can see exactly where the work goes. The picture is striking: the heaviest work is the most mechanical.

Two reading decisions, Signal Extraction and Evidence Analysis, carry two-thirds of everything an investigation processes. The pure judgment calls, choosing what to ask and making the final call, account for less than a tenth. The engine was designed to turn exactly that gap into speed.

Right-sizing every decision

Aura routes each decision to the smallest model that provably holds its quality. Small models do the reading. Mid-size models write the findings and make the call. The flagship model is reserved for the two moments that shape everything else: planning the investigation and challenging its findings.

Decision	What it does	Model	Why
Signal Extraction	Extracts entities, indicators and IOCs from every slice of evidence	Small	Narrow, high-volume extraction
Evidence Analysis	Answers the investigation’s questions against the evidence and builds the timeline	Small	Every answer must cite evidence the engine verifies
Context Recall	Finds the organization’s knowledge and past cases that apply	Small	Retrieval and relevance against a known set
Investigation Plan	Decides what this investigation must establish	Flagship	Sets the frame; mature case types are served with no model call at all
Findings	Turns observations into typed findings with disposition, confidence and weight	Mid-size, flagship-reviewed	Where evidence becomes meaning
Verdict	Decides, over findings only	Mid-size	Reasons deeply over a compact set of findings, not raw evidence

The effect, measured on the same real production cases:

Engine	Work on small models	Time to verdict	Cost per verdict
Previous generation	none	baseline	baseline
Aura engine	nearly 90%	about 2.5× faster	about 80% lower

The speed comes from the whole design working together. Decisions run in parallel, the verdict reasons over a compact set of findings rather than raw evidence, and each decision runs on the fastest model that can do its job. The engine puts the flagship model only where it changes the outcome, mid-size models where judgment matters, and small models, which write about twice as fast, everywhere else.

Quality is engineered, not hoped for

Smaller never means riskier with Aura, because no decision changes models on faith. Every move is proven against real outcomes first, and the outcome we check first is the one that matters most: a real threat called benign (i.e., false positives).

Proven in the Lab first. Before any decision changes model, it is replayed across thousands of real investigations and judged against expert outcomes. Nothing reaches a customer until the evidence says it should.

Ground truth from expert analysts. Aura's verdicts are continuously checked by our own security analysts, giving the engine a constantly growing body of expert-confirmed outcomes to measure against. When Aura calls a case benign and an analyst reviews it, they agree more than 99% of the time. New case types earn autonomy the same way: Aura closes them on its own only after it has proven itself on them.

Built to catch what others miss. When we moved Signal Extraction to a small model, the Lab spotted a subtle behavior: the small model was occasionally reading empty lookups as evidence. No customer ever saw it. We tightened that decision's contract, replayed again, and shipped a version that is about 95% cheaper and 3× faster with verdicts unchanged. That is the method behind every decision in the engine: move it, replay it, prove it.

What customers see.

In production today	Result
Aura verdicts that stand unchanged through case close	over 98%
Verdicts that were right, or erred on the side of caution	99.9%
Cases closed by Aura with no human touch	close to 9 in 10
Autonomous closures that stayed closed	99.95%

What it means for our customers

Faster and cheaper are engineering results. Here is what they mean for our customers:

Every alert investigated, not triaged away. When a full investigation costs a fraction of what it used to, there is no reason to skip one. Coverage stops being a budget decision.
Answers in minutes. Aura completes an investigation in about a minute and a half on average, the moment the alert arrives.
Verdicts you can count on, release after release. Each decision is pinned to its own model and proven in the Lab before anything changes, so a new model upstream is an upgrade we choose, never a surprise.
Analysts focused on real threats. Most of the cases that reach an analyst need only seconds of review, so expert time goes where it matters: the threats that need a human.

The engine is the product

This year many security vendors announced that they had built a better model. We think the harder and more durable thing is an engine that needs less of one: one that knows which decisions deserve a flagship model, tests that on real cases, and gives everything else to models that are faster and cheaper by an order of magnitude.

The verdict pipeline is where we started, because it is where most of the tokens were. The same approach (decompose, route, replay, prove) is now coming to threat hunting and to Aura's agents. Wherever the work is reading, small models will do it. Wherever it is judgment, we will spend accordingly, and show our work.

‍