Drift ·
The person holding the pager at 2am is not an ML specialist
Most agent security is written for people who will never read it.
Here is a real alert, in the form most tools emit it: CRITICAL · agent-7 · baseline deviation detected · egress_volume 4.7σ above mean · μ=2.1MB σ=0.8MB observed=5.9MB.
It is accurate. It is also going to be overruled, because the person holding the pager at two in the morning is usually not the person who deployed that agent, and nothing in that string tells them whether to wake anyone up.
Here is the same event: This agent just sent 5.9 MB to an address it has never contacted before. It normally sends about 2 MB, only to your GitHub. It is holding your AWS deploy key.
Three parts, always. What it did. What is normal for it. What it was holding at the time. That third clause is what converts a statistic into a decision, and it is the one most tools cannot produce because they never tracked what the agent had access to.
The translation has to be generated from the same primitives as the detection — byte counts, hostnames, tool names — and never from a model. A language model writing the explanation would be free to invent a consequence that the evidence does not support, which is precisely the failure mode you are trying to catch. Determinism in the alert text is not a nicety. It is what makes the alert admissible.
There is a broader point here about who this field is being built for. Agent security is currently written by specialists, for specialists, in a vocabulary that assumes familiarity with distributions. The organisations that most need it — the hospital, the credit union, the manufacturer with four people in IT — have nobody who reads sigma notation and never will. If the alert requires a specialist to interpret, the product only works at companies that already have one, which are the companies least at risk.
Democratising this is not a marketing posture. It is the difference between a detection that fires and a detection that gets acted on.