Los Angeles – October 29, 2026 -- Kindo has launched Deep Hat Sift, a self-improving model that decides which events in alerts, tickets and logs need a large language model and skips the rest. The product targets enterprises that pay for an LLM to review every event or keep AI agents off their busiest data sources altogether.
Sift learns from the verdicts of the agent it serves
Deep Hat Sift is a System One decision model, a fast, inexpensive class of AI that answers yes or no rather than generating text. Fixed-weight filters must be retrained and re-released to improve. Sift instead trains on the verdicts of its target agent, so no labeling project or vendor retraining is required.
Each Sift model is assigned to one data source, one target agent and one filtering task. According to Kindo, a large enterprise can run hundreds of thousands of them at once.
Filtering starts only after a person approves a threshold in writing
Sift first runs in shadow mode, scoring every event while the agent still receives all of them. It then previews on the customer's own events what it would filter. Filtering begins only after a person approves a threshold with a written reason.
A random sample of events that would have been withheld keeps going to the agent, so the miss rate is continuously measured. Every filtered event is recorded for transparency and compliance. If quality drifts, the system fails open and sends everything to the LLM.
"It filters nothing until a person approves the threshold," said Troy Presley, Deep Hat Sift engineer at Kindo.
Sift targets SIEM, EDR, Splunk, Datadog and Kafka streams
The model works in front of SIEM and EDR alerts, ticket and alert queues, system and network logs, monitoring tools including New Relic, Splunk and Datadog, and streaming systems such as Kafka. Lead use cases are alert storms, alert and ticket triage, log streams and reported-phishing triage. Compliance and Finance teams can also use it for real-time review of event streams for policy anomalies and fraud indicators.
Gartner forecasts 150,000 agents per Fortune 500 company by 2028
Kindo cites Gartner's prediction that by 2028 an average global Fortune 500 enterprise will have over 150,000 agents in use, up from fewer than 15 in 2025. Finance and IT leaders face growing pressure to justify agent costs. Kindo frames Sift as adding "LLM use avoidance" as a cost lever, meaning the LLM is not used at all when an event does not warrant it.
Kindo also points to Gartner's September 2026 guardian-agent research. Gartner calculates that an agent making 10 calls with a 10% error rate per step completes the overall task successfully only about a third of the time. Gartner says guardian agents use deterministic rules and small language models for low- to medium-ambiguity tasks and escalate only complex anomalies to human supervisors.
Deep Hat Sift joins Deep Hat Attack in Kindo's model family
Sift joins the Deep Hat family alongside Deep Hat Attack, a model for authorized offensive security testing with a human in the loop. Kindo says general-purpose AI lab models have either restricted such testing or priced it unaffordably.
Deep Hat Sift is available now. It runs on premise, in self-managed cloud, in Kindo's cloud or air-gapped, the last option aimed at defense and regulated industries. Scoring runs where the customer installs Kindo, and Sift holds no model-provider or data keys.