Fig. 4 / Side by side, one alert

FIG. 4Side by side, one alertalert:

Triage agent (Sonnet 5), 197 s

0.0 s

replayed at 16x · steps placed by their tool timestamps · y axis not to scale

model calls0 tokens generated0 tokens in0 cache write0 cache read0 cost$0.34 avg per alert, measured in production probabilitynone

Jev, from the alert alone, 0.5 s

0 ms

model calls0 Jev calls0 text generatednone cost$0 probabilitynone yet

The agent, after 197 s and 9 model calls: not escalated, legitimate MDE diagnostic tooling. Jev, from the alert alone, in 0.5 s: not escalated, p=0.92. Three LLM judges, given all the evidence: not escalated.