Stellar Cyber, the full-cycle AI-native security operations platform company, today released results from an independent study of 124 days of customer trials of its Agentic Auto Triage capability.
The independent study based on customer trials evaluated 138,475 real security alerts and reached the same verdict as human analysts 99.7% of the time. The findings, drawn from customer-submitted end-of-trial reports, addressed the central question facing every security team weighing autonomous SOC technology: Can AI actually be trusted to make decisions?
AI-driven tools have made it easier than ever for adversaries to design highly convincing phishing and ransomware attacks. In response, organizations have doubled down on security awareness and training, resulting in a surge in reports of potential threats. The World Economic Forum reports potential security threats have surged dramatically over the last two years, with ransomware attacks jumping by up to 48% year-over-year and phishing attempts exploding by 1200% since late 2022. This escalation is largely driven by GenAI-enhanced tactics. Automatic Triage, powered by Agentic AI, levels the playing field for human security analysts by automatically ingesting, correlating, analyzing, and prioritizing suspicious events from the user’s environment.
Finding #1: Auto Triage returns 19 minutes of every hour, translating to 1 day a week of productivity
Across the trials, Auto Triage returned roughly 19 minutes of every analyst hour to higher-value work, including working more cases per shift and dedicating more time to exposure management, anticipating adversary behavior, and closing exposures. This time translates to about one day per week per analyst, or the equivalent of 1.5 full-time analysts reclaimed annually.
“Security operations have reached a tipping point. The volume and complexity of alerts are simply beyond what human analysts can manage alone,” said Aimei Wei, CTO at Stellar Cyber. “This real-world study proves that our approach of combining machine-speed analysis with human judgment is the right way forward. These results show what that looks like in practice: the AI does the alert work at scale, the analyst stays in control, and they almost always agree—freeing analysts to manage more cases and get ahead of emerging exposure.”
Finding #2: 64% of False Positives closed; 15% of True Positives escalated
Using machine learning models trained on real-world phishing patterns, the platform delivers reliable, actionable verdicts in seconds. Auto Triage assigns each alert a decision through an AI-driven Verdict Signal Check, with human-in-the-loop oversight and a closed-loop learning process that improves accuracy over time.
During the trials, the system analyzed 138,475 alerts, disposing of 64% of them as confident false-positive closures. Auto Triage escalated 15% of the alerts as true positives for human analyst review, and routed the remainder as informational, clearing noise before it reached a person.
“The Agentic AI built into Auto Triage is designed to address one of the most pressing challenges security analysts deal with on a daily basis: tuning out the noise and focusing on legitimate threats to the business,” said Christopher M. Steffen, CISSP, CISA, CCZT, VP of Research, Information Security, Risk, and Compliance Management at EMA. “This study proves that Stellar Cyber’s approach of automatic ingestion and analysis, AI-driven prioritization, and highly accurate decision-making has the power to transform the way analysts work in the enterprise SOC—from processing alerts to managing cases, moving from MTTD and MTTR, towards MTTN – mean time to neutralize, and spending more time proactively reducing exposure.”
Lean security teams at enterprise SOCs and MSSPs face mounting alert volumes without the budget to scale headcount. For MSSPs, reclaimed analyst capacity translates directly into broader coverage, better customer service, and protected margins.
“The results from this study underscore what we’ve experienced in our own SOC. For an MSSP, the math of human-only security operations simply can’t scale against today’s alert volumes,” said Chant Vartanian, CEO, M-Theory Group. “Auto Triage effectively returns a full day of productivity per analyst and successfully closes 64% of false positives. That data is truly transformative for organizations like ours. It allows us to shift our team’s focus to high-value threat investigation and exposure management, work more cases per shift, which directly improves our service margins and enables us to provide broader, more consistent coverage for our clients without the need for costly headcount expansion.”
Auto Triage is available now as part of the Stellar Cyber AI-native SecOps platform. Stellar Cyber will showcase Auto Triage and the results of this independent study live at Black Hat USA (Booth #5542), August 1-6, 2026, in Las Vegas. Book a demo today!
- Black Hat
- Black Hat USA 2026
- Stellar Cyber
