Kindo Launches Deep Hat Sift to Cut Unnecessary AI Agent Runs

An AI agent that reads every security alert or log entry incurs a cost even when its conclusion is that nothing needs doing. At enterprise volumes, those uneventful investigations can become a substantial workload of their own. Kindo has launched Deep Hat Sift, a model designed to decide which incoming events warrant an agent run before the larger model starts processing them.

Announced October 28, Sift learns from the verdicts of the agent it serves, then filters events that the agent would otherwise dismiss. The product starts by observing rather than withholding: every event still reaches the agent until a person reviews the proposed filtering behaviour and approves a threshold.

The approach introduces a different cost-control mechanism from selecting a cheaper language model. Instead of lowering the price of each investigation, Sift aims to avoid investigations that are unlikely to require action. Its effectiveness depends on both the quality of those decisions and the controls around what gets skipped.

A Decision Model Before the Language Model

Kindo describes Deep Hat Sift as a System One decision model: a fast, inexpensive model that answers a selection question rather than generating a response. Each model is assigned to a particular source, target agent and filtering task, so its learning reflects the workload it is intended to serve.

That specificity matters. An event relevant to a security investigation may be irrelevant to a service-desk workflow. Sift learns which events its target agent dismisses, using the agent’s returned verdicts as its training signal. Kindo says this avoids a separate human-labelling project for each stream.

The initial deployment runs in shadow mode. Sift scores incoming events while the agent continues to inspect all of them, allowing the system to compare its predictions with the agent’s decisions. Before filtering begins, operators receive a preview of what would have been withheld on their own data.

A person must then approve a threshold and provide a written reason. This places the decision about acceptable filtering behaviour with the team responsible for the workflow, rather than treating activation as an automatic consequence of installing the model.

Sampling and Fail-Open Controls Address What Gets Missed

Filtering introduces a difficult measurement problem: if an event never reaches the agent, how does the team know whether it should have? Sift continues to send a random sample of events that it would otherwise withhold, allowing the agent’s verdicts on that sample to inform an ongoing miss-rate measurement.

The product page makes the reference point explicit: recall and miss rate are measured against the agent’s judgments. Those metrics indicate how closely Sift reproduces that agent’s decisions. They do not independently establish whether the agent itself correctly identifies every security incident or operational issue.

Kindo says Sift fails open if quality drifts, sending events back through for agent review rather than continuing to suppress them. The company also describes activity ceilings that can return the system to shadow mode during a spike. Filtered events and approval decisions are logged so teams can examine what was withheld and why.

“It filters nothing until a person approves the threshold, and if quality drifts it fails open and sends everything through for LLM judgment,” said Troy Presley, a Deep Hat Sift engineer at Kindo, in the announcement.

These mechanisms expose the trade-off rather than eliminating it. More conservative filtering can preserve coverage while saving fewer runs. More aggressive filtering may avoid more work but places greater importance on sampling, drift detection and the quality of the downstream agent.

Designed for Alerts, Tickets and Continuous Log Streams

The launch targets workloads where incoming volume is high and the proportion requiring action is low. Kindo names SIEM and endpoint-detection alerts, ticket queues, reported-phishing submissions, system and network logs, and streams from platforms such as Kafka. Monitoring sources include Splunk, Datadog and New Relic.

Sift sits ahead of the agent rather than replacing these source systems. A security platform continues to generate detections, a ticketing system continues to hold its queue, and the agent remains responsible for the cases that reach it. The new layer decides which events initiate that additional AI work.

The same pattern could apply to finance and compliance workflows that review transaction or policy streams. Here too, selecting events for review is distinct from providing a fraud-detection or compliance determination. The target agent and the surrounding business process remain important parts of the outcome.

How Sift Fits Into Kindo’s Agent Management Platform

Kindo’s broader platform connects agents with enterprise systems for security, infrastructure and IT operations. It combines execution with context, permissions and operational oversight, giving teams a place to manage the work after a model has been selected.

The company’s website describes agent ownership, access policies and cost attribution by agent, owner and team. Sift adds a control at an earlier point in that workflow: deciding whether an event should cause an agent to run at all. This connects a technical filtering decision with the operational question of which workloads are generating inference costs.

According to the launch announcement, Deep Hat Sift is available now on premises, in a self-managed cloud, in Kindo’s cloud and in air-gapped environments. Scoring runs where Kindo is installed, while model calls are managed through the platform. The product operates with Kindo agents.

The Savings Will Depend on the Stream

Kindo has not supplied a general percentage saving or a universal accuracy benchmark for Sift. Its product page instead directs teams to preview withholding on their own events. That is a useful distinction for buyers: the economic result depends on event volume, the cost of each avoided run, the share of actionable events and the operating threshold the team accepts.

For noisy streams, avoiding unnecessary agent runs could make continuous AI review more affordable. For streams where a missed event has serious consequences, the sampling and escalation controls become just as important as the inference bill. Deep Hat Sift brings those decisions into the agent workflow, with the central question shifting from which model should handle an event to whether that model needs to handle it at all.