For the fourth year running, Sophos AI will share new research at the Conference on Applied Machine Learning in Information Security (CAMLIS). On October 23, Senior AI/ML Engineer Tamás Nyiri will lead a poster session entitled “Show, Don’t Tell: Calibrating Agentic SOC Analysts via Hierarchical Evidence Graphs.”
This research turns traces used in agentic investigations into features for a traditional ML model, which helps calibrate the agent’s verdicts and flag the cases it most likely got wrong.
A matter of fact
SOCs increasingly use AI agents to investigate alerts. Those agents extract entities and context connected to alerts, plan investigation steps, query tools, and produce reports containing final verdict.
While such agents can save analysts time, they can also fail in both predictable and surprising ways. An agent may treat a failed or missing check as evidence that nothing is wrong, link events simply because they happened close together, judge a legitimate installer or developer tool by its behavior alone, or close a case prematurely. These mistakes can be hard to spot, especially since reports tend to tell a confident story, while the evidence is buried in a long investigation trace.
Motivated by this challenge, Tamás developed an approach that makes an investigation agent show its evidence. First, the investigation steps are converted into a ‘fact graph,’ with the agent’s report and verdict withheld. Structured trace fields are parsed, while an LLM extracts meaning from free text under a fixed schema. The graph records what was observed, which tool calls failed, and how entities relate to one another. It also infers what is missing, such as unexamined alternative explanations and unqueried sources.
The fact graph is useful on its own, but here it serves as a building block for three evidence views:
- Coverage: were the necessary checks actually run?
- Context: do events link to the right entity, and is there a benign explanation?
- Readiness: does the evidence justify a decision?
Features from these views feed a simple supervised model that estimates how likely a senior reviewer is to disagree with the agent’s verdict.
Show me the results
The training labels come from a two-stage human review. First, an analyst examines each agent investigation and gives a verdict; a senior analyst then reviews both and sets the final verdict, which serves as ground truth. The model is a regularized logistic regression, fit separately for three yes/no questions:
- Is the investigation conclusive?
- Is the initial alert a true positive
- Is the underlying content malicious in nature?
Alongside the evidence features, the model uses the agent’s verdict as a prior, based on how often reviewers agreed with that verdict in the training cases. This is necessary because labeling is costly and, at this training size, overfitting is unavoidable. Each of the 314 cases is scored by a model trained on the other 313 (leave-one-out cross-validation), so no case contributes to its own score.
The research is still at the proof-of-concept stage, with many improvements planned, but even this simple version shows an encouraging signal. Ranking cases by the model’s disagreement score brought agent errors to the front of the review queue. The senior reviewer overturned the agent’s verdict in 25% of all cases, but in 65% of the 20 highest-scoring cases: roughly 2.6 times the base rate.
During the session, Tamás will walk through the methodology, an example fact graph from a real case, and the lessons learned along the way.
If you’re attending CAMLIS, feel free to stop by Tamás’ poster to discuss your thoughts on this emerging research direction – and keep an eye out for more details of this approach in the near future.
About Author
