AI in cyber defence: tier-zero triage, intelligence and oversight
AI at Fortgale works inside the MDIR cycle: it gives weight to alerts (noise reduced by more than 90% from day 30), correlates signals with 287 actor and tool profiles, and in the portal answers customer questions through three assistants working only on the customer's data. Analysts decide, AI accelerates.
Two different AIs: the one that defends and the one to defend
When people talk about AI and security they mean two different things. The first is AI that defends: technology serving the SOC, which reads signals, ranks them and relates them to what is known about the adversary. The second is AI to be defended: the artificial intelligence systems a company adopts, from copilots to internal applications, which have an attack surface of their own and are the perimeter of the AI Security service. This guide is about the first. Mixing them up leads to promising, or demanding, different things.
At Fortgale, defensive AI is integrated into the platform and applied to the customer’s data, inside the cycle of a managed service. It is not a separate product and it does not replace people.
AI-native tier-zero: what automatic triage does and what stays human
Tier-zero is the first level of reading for every alert, before it reaches a human. Here AI does three things: it reads the alert in the customer’s context, compares it with adversary profiles and discards what has no relevance. The measurable result is noise reduced by more than 90% by day 30.
Everything that needs judgement and accountability stays human: assessing the incident, deciding containment, talking to the customer, feeding the techniques observed in the field back into the profiles. The median times that matter are those of the service: TTD under 15 minutes, TTC under 30. Tier-zero exists so that fewer, more relevant signals reach the analyst.
The I in MDIR: intelligence that gives alerts weight
An alert without context is an isolated fact. With 287 profiles of adversary groups and attack tools, every signal is read against what is known about the attacker. A login with valid credentials (T1078) is an ordinary event until the command infrastructure matches that of a group targeting the customer’s sector: from then on it has a name, a history and a priority.
This is why Fortgale speaks of MDIR, Managed Detection, Intelligence and Response: intelligence does not arrive downstream as a list of indicators, it circulates in the cycle. The term, and the limits with which we use it, are explained in MDIR: Managed Detection, Intelligence and Response.
AI Assistant in the portal
In the customer portal the AI Assistant offers three assistants, Technical, CISO and Intel, which answer questions about the perimeter and incidents using only the customer’s data. Each contract year includes 5 AI credits. It is AI integrated into the platform and applied to the customer’s data, on European infrastructure. The full description is on the Fortgale Defence Platform page.
Human oversight, model degradation, transparency: what supervisors ask and what we do
Regulatory attention to AI in cybersecurity grew sharply in summer 2026. The ECB letter «Addressing AI-enabled cybersecurity threats» of 7 July 2026 addresses the threats enabled by AI. The ESAs Statement JC 2026 25 of 31 July 2026 and the ESRB Warning ESRB/2026/3, which rates the risk as «severe», place the topic at European level, for financial entities in particular. The common expectations are consistent: use AI in defence where appropriate, with a risk assessment, human oversight and control of model degradation.
Our answer is structural. Human oversight: every response goes through an analyst. Model degradation: the comparison between raw alerts and alerts brought to the analyst is a continuous measure, and a drop in quality shows in the customer’s numbers. Transparency: AI is declared in the cycle, with its role and its limits.
What AI does not do on its own
- It does not start automatic responses without an analyst: a containment action is a human decision.
- It does not replace human CTI: adversary profiles come from the analysis of real incidents and are kept alive by the team.
- It does not eliminate prompt injection and the other risks of AI systems: it reduces them with controls and oversight, it does not cancel them.
Saying what AI does not do is part of the service: whoever promises a SOC without people promises what nobody can prove.
AI speeds up reading, intelligence names the adversary, analysts decide. Three distinct roles, one cycle: this is how an attack is stopped in time. The AI systems to be protected are the subject of AI Security.
Frequently asked.
Does AI replace the SOC?
No. AI works at the first level, tier-zero triage, and speeds up the reading and ranking of signals. Containment, response and decisions stay with the analysts of the Milan SOC, operating since 2017. No response action starts without an analyst.
Does customer data train public models?
No. Customer data does not train public models: the assistants answer on the customer's data only, on European infrastructure.
How is the noise reduction measured?
By comparing the raw alerts generated by the sources with the alerts actually brought to the analyst. The result is a reduction of more than 90% from day 30, measured on each customer.
From theory to a real operation.
What you read here, Fortgale runs every day with a European SOC 24·7·365: 287 tools and actors profiled, <30 min median containment. Explore the service: Fortgale Defence Platform.
Related resources: MDIR: Managed Detection, Intelligence and Response · What is CTI · What is MDR
A technical conversation, not a funnel.
Leave your details: an analyst calls you back within one business day. European SOC, same time zone, proprietary intelligence on the actors active across the EU.