Multi-Model AI Architecture
The right model for each security workload
Triage classification, investigation reasoning, natural language search, and report generation have different latency, accuracy, and cost requirements. ManySignal routes each task to a specialized model and combines outputs in a structured reasoning chain.
How workloads are routed
Each request carries a task type tag. The routing layer selects a model based on configured performance targets — not a one-size-fits-all default.
Alert classification
Fast classification model
Latency target: <300 ms
Binary and multi-class verdict on structured context bundles
Investigation reasoning
Large reasoning model
Latency target: <8 s
Multi-step chain-of-thought over entity graph subgraphs
Natural language search
Embedding + retrieval model
Latency target: <500 ms
Semantic query expansion over 180-day log index
Report generation
Long-context narrative model
Latency target: <15 s
Structured case summary with evidence citations
Code and YAML analysis
Code-specialized model
Latency target: <2 s
Detection rule linting, threat hunting query synthesis
Threat intel extraction
NER extraction model
Latency target: <400 ms
IOC, TTP, and actor extraction from unstructured reports
Model outputs are structured, not free text
Every model call is framed with a typed output schema. Verdict, confidence score, contributing signals, and reasoning steps are parsed from the model response before they touch any downstream system. If the model returns malformed output, the workload fails closed — not silently forwarded as a confident verdict.
Reasoning traces are stored verbatim in the case timeline. Analysts see exactly what the model was given, what it returned, and how that output was weighted in the final verdict.
What multi-model routing delivers
Cost proportional to task complexity
Fast binary classification runs on a small model at 1/20th the token cost of a large reasoning call. You pay for capability only where it matters.
Latency targets per workload
Triage must complete before an analyst opens a ticket. Investigation can take seconds. Report generation can take minutes. Each task class has an independent latency budget.
Model fallback and retry
If the primary model for a task exceeds its latency target or returns an error, the orchestration layer retries on a designated fallback model. No single vendor outage breaks the pipeline.
Vendor independence
Model providers are configured as named adapters. Swapping the classification model from one vendor to another requires a config change, not a code change.
Prompt versioning
Every system prompt and context template is versioned. You can compare verdicts across prompt versions on historical alerts to measure the impact of prompt changes before promoting them.
Audit trail on every inference
Model ID, prompt hash, input token count, output token count, latency, and parsed output are written to the audit log for every inference. Required for compliance reporting and model performance review.
Multi-Model AI — FAQ
Which AI providers does ManySignal support?
The platform ships adapters for major cloud AI providers and select specialized security AI vendors. The adapter interface is documented in the SDK, allowing teams with enterprise AI agreements to configure their own provider endpoints.
Does customer data leave my cloud region for AI inference?
Inference requests are routed to model endpoints in the same cloud region as your tenant by default. For self-hosted deployments, all inference can run on-premises using the on-prem model adapter.
How are prompts protected against injection?
Context bundles passed to models are structured JSON, not user-controlled free text interpolated into prompts. Event field values are escaped and truncated before insertion. Alert titles and descriptions are treated as untrusted strings.
Can I bring my own fine-tuned model?
Yes. Any model accessible via an OpenAI-compatible API can be configured as a named adapter. You define which task types it handles and its latency SLA, and the router includes it in the selection pool.
How does the model router decide which AI model to use for a given task?
The router selects models based on task type, latency requirement, and configured cost ceiling. Fast pre-filter verdicts route to smaller, cheaper models; deep-investigation question sets route to the highest-capability model available. Task-to-model mappings are configurable per agent definition.
What happens if the primary AI model is unavailable?
The model router falls back to the next configured adapter in priority order. Fallback is transparent to the analyst — the verdict is generated by the fallback model, and the model used is recorded in the evidence trail. A P0 incident fires if all configured model adapters are unavailable.
Is model output non-deterministic and how does that affect reliability?
Yes, LLM outputs have inherent variability. ManySignal mitigates this through structured question sets (yes/no/partial answers with evidence citation), answer validation against a defined schema, and confidence calibration. Verdicts that fail schema validation are flagged for analyst review rather than surfacing as confident outputs.
Can we use an enterprise AI contract (Azure OpenAI, Vertex AI) instead of ManySignal's default models?
Yes. If your organisation has an enterprise AI agreement with Azure OpenAI Service or Google Vertex AI, you can configure ManySignal to route inference through those endpoints. This gives your legal and procurement teams visibility into the AI supply chain and may satisfy internal AI governance requirements.
Does ManySignal use AI for anything beyond triage verdicts?
Yes. AI is used for: natural-language event search query translation, entity resolution fuzzy-matching, automated report generation (monthly MDR reports), coverage gap analysis recommendations, and the agent builder question-set evaluation scoring. Each use is documented and the AI involvement is disclosed in the UI.
AI that explains its reasoning
Every verdict comes with a traceable reasoning chain — not a confidence score with no context.