A first test drive with Microsoft-Decision-1: Reviewing alert severity
·6 mins
AI decision models are the new kids on the block, with TypeSafe AI’s Jev,1 Cloudflare’s Clef,2 and Microsoft-Decision-1.3 Frontier models are powerful for complex analysis and generating text, but automation often needs smaller answers: which category, which queue, or whether to escalate. Decision models focus on these bounded tasks, returning structured choices and probabilities without generating free-form text. This can reduce latency and cost while giving AI-based workflows outputs they can act on directly. Probability thresholds can then determine whether to proceed, request another evaluation, or hand the decision to a human in the loop.
In short:
An AI decision model reads an input and returns an answer from a set you define (an option, a score, or the probability that something is true), with a calibrated probability for every allowed answer, in one pass and without generating text. - System One Models4
So I was curious to test the Microsoft-Decision-1 model and better understand how it works in an experiment related to SecOps and incident automation.
My Experiment # When alert volumes are high, SOC teams tend to prioritize medium- and high-severity alerts and use automation to triage or close lower-severity alerts. I tested whether Microsoft-Decision-1 could identify alerts worth escalating or recommend a lower severity based on the alert and included alert evidence. These outcomes could support incident reviews by highlighting alerts that are worth another look or support detection engineering to adjust a detection’s severity level.