Tier 1 - triage and summarisation
A language model can help organise logs, sandbox results, and threat-feed context into a readable summary. It can omit evidence or produce unsupported conclusions, so an analyst must verify each claim before acting.
Tier 2 - phishing and pattern detection
Machine-learning classifiers can help identify patterns when independently evaluated on representative data. Performance depends on the dataset and operating conditions; there is no universal detection rate.
Tier 3 - policy and report drafting
AI can draft a first version of a policy, incident report, or remediation ticket. A qualified reviewer still needs to check accuracy, source evidence, and any legal or operational implications.
Where it's still marketing
Autonomous response, fully automated threat hunting, and 'agentic' security operations. All impressive demos, none ready for unsupervised production use on critical systems in 2026.
Privacy trade-offs
Before sending security data to a hosted service, check what is collected, where it is processed, how long it is retained, and whether it may be used for training. Redact or omit sensitive data unless the organisation has approved that flow.
CitadelFrame AI status
CitadelFrame backend AI threat analysis is not available. The Frame Agent source now contains a bounded Microsoft Defender Operational event-1116 reader and a Gate reporter that requires stable event identity and original time. Parser/reporter tests and synthetic PostgreSQL replay pass, but no positive or negative real Defender detection has been verified on a disposable Windows endpoint. Gate receives metadata and an optional SHA-256 only; file contents and samples are not sent, and no scan data is sent to an AI model. The asynchronous analyzer, provider, retention policy, consent flow, and reviewer workflow have not been selected or released.