Kindo introduced Deep Hat Sift on October 28, 2026, to reduce the number of times enterprises call a large language model (LLM) to review alerts, tickets, and system logs. Sift sits between an incoming event stream and a Kindo AI agent. It learns which events that agent tends to dismiss and, after a human approves a threshold, can withhold similar events from agent review while keeping a record of each decision.
In a security operations center, an alert surge can generate thousands of potential agent runs, each consuming model tokens and processing time. Sift targets the cost of deciding which events deserve that work. The security or ticketing system still produces the events, and the agent investigates the ones it receives. Sift handles the decision to start an agent run.
How teams move from shadow mode to live filtering
Each filter is configured for a specific data source, agent, and task. A security team could, for example, pair a reported-phishing queue with an agent that decides whether a message warrants investigation. The team first defines what should reach the agent. Kindo’s setup guide describes a review set of about 50 events drawn from the source. Reviewers judge each example, and an operator or administrator approves the set before the filter enters shadow mode.
In a standard shadow run, Sift scores incoming events while the agent continues to review them. The agent’s decisions give Sift examples of what warrants action and what can be dismissed. The team can then preview how many agent runs a proposed threshold would avoid and how many events the agent judged actionable it would have withheld. Live filtering requires a separate threshold approval, which Kindo records along with the approver’s reason.
What the miss rate measures
Once filtering is active, Sift randomly sends some events it would otherwise withhold to the agent. Kindo documents a default sampling rate of 3%, adjustable from 1% to 5%. Sift uses the agent’s decisions on those events, along with its decisions on events sent through normally, to estimate the share of actionable events the filter missed. The console shows a 95% confidence interval and waits for enough verdicts before reporting an estimate.
The benchmark is the agent’s own judgment. If the agent dismisses a real phishing attempt, that verdict can also carry through to the filter’s measurements. Human corrections replace the original agent verdict in the reported figures. Kindo also documents a default setting that returns the filter to shadow mode if performance falls below its approved limit, so the team can review the filter while agent review resumes.
How to evaluate cost and deployment
Sift reports how many agent runs it avoided. During shadow mode, the same view shows how many runs it would have avoided under the proposed threshold. To estimate the financial effect, an operations team can compare avoided runs with its own model usage and include the cost of operating the filter. A high-volume queue where the agent regularly dismisses events gives teams a concrete place to measure both the potential savings and the risk of withholding something that needs attention.
Kindo said Deep Hat Sift was available at launch for its AI agent management platform. The service works with Kindo agents and reads events through integrations already connected to the customer’s Kindo environment. Kindo lists ServiceNow and Jira ticket queues, Splunk and Datadog monitoring data, and Kafka event streams among its examples. Deployment options include Kindo’s cloud, a customer-managed cloud, on-premises infrastructure, and air-gapped environments.
Sources
ERP News Editorial Team
The ERPNews Editorial Team covers global developments in ERP (Enterprise Resource Planning), enterprise software, cloud platforms, AI, automation, and digital transformation, providing independent news and editorial analysis for senior business and technology leaders. Our reporting focuses on market signals, strategic shifts, and enterprise impact across the ERP and enterprise technology ecosystem.
For editorial inquiries, please contact:
📩 [email protected]
