{"slug": "52-security-tools-one-judgment-layer-35-seconds", "title": "52 security tools, one judgment layer, 35 seconds", "summary": "A developer integrated TypeSafe's Jev, a non-LLM model that evaluates states against typed questions and returns probabilistic verdicts, as a judgment layer over a 52-tool security panel. In a pipeline run, 25 tools produced 24 findings in 35.15 seconds, and Jev classified all 24 in a single pass, splitting 12 true positives from 12 noise with confidence scores such as 0.86 and 0.89 for genuine issues and 0.92 for noise. The developer reports the layer reorders findings by severity times AI verdict and resolves ambiguous high-severity alerts, including an unsigned GPU-Z driver, in under a minute.", "body_md": "I run my own panel with 52 security tools spread across seven categories, and it is not a toy.\n\nIt scans ports, resolves DNS, checks headers, enumerates subdomains, hunts for secrets, reviews vulnerabilities, and then I have another one that audits Windows itself.\n\nThe problem showed up the day I chained the tools into a pipeline and ran the whole thing.\n\nThat chain produced twenty-five tools in 35 seconds and twenty-four findings on the table.\n\nThat is where the real problem started, and it is not finding things. It is that someone has to look at all of them, sort them, and decide which ones matter before the day ends.\n\nThe temptation was to add another tool, make it super complex and intimidating, and that was the wrong answer.\n\nWhat was missing was a judgment layer on top of the list, something that would read the 24 findings and say which are real, which are noise, and which it does not trust enough.\n\nFor that I integrated Jev, which is not an LLM but a new tool, the model TypeSafe published on September 15 (Source: docs.typesafe.ai).\n\nJev does not generate text, it evaluates a state against typed questions and returns an answer with an associated probability, and that is exactly what I needed. When I saw it announced I said this is perfect (and cheap).\n\nI did not touch a single line of the scanners, because the AI layer hooks into the findings list the panel was already aggregating.\n\nThe nuclear pipeline launched 25 tools in 35.15 seconds and produced 24 findings.\n\nJev evaluated all 24 in a single pass and split 12 true positives from 12 noise.\n\n*The run: 25 tools, 24 findings, and a verdict with its confidence on every row.*\n\nA tiny cost for working with 24 findings.\n\nThat kills the argument that AI is not affordable for a small or large SOC. The cost of the judgment layer is statistical noise next to the time this beast saves, and by the way this has existed for a long time but someone had the good sense to commercialize it.\n\nWhat convinced me most was not a hit, it was a dry 0.32.\n\nAn alternate HTTP port came out with that confidence, and the panel did not flag it as a threat, it flagged it as review.\n\nThe missing security headers came out at 0.86 and 0.89, those are true without discussion.\n\nTasks that simply completed, like whois or DNS, came out as noise at 0.92.\n\n*The export: 0.86 and 0.89 on what is true, 0.92 on noise, and 0.32 on what needs a look.*\n\nThe difference between 0.32 and 0.89 is the difference between an alarm you chase for half an hour and one you document and close.\n\nThen the panel reorders the whole queue by severity multiplied by the AI verdict, which is what actually changes your morning.\n\nThe second layer came from the other side.\n\nMy PowerShell audit project walks a Windows machine through ten modules and sends its findings to the same panel.\n\nOne of those audits flagged two high-severity threats.\n\nThe first was an unsigned driver loaded from my user's temp folder.\n\nThe second, a process running in memory whose binary was no longer on disk.\n\nRead cold, those two are a rootkit and an injection, and anyone who has done triage would put them at the top of the queue.\n\nThe driver is called GPU-Z-v8.sys (I thought of Dragon Ball) and it belongs to the GPU monitoring tool that leaves its file in the temp folder, and the file is from July 28 with the program not even installed on the machine anymore.\n\nJev gave it 0.76 confidence and a 24 percent probability of false positive.\n\nThe other came out at 0.79 with 21 percent.\n\n*Both high-severity verdicts and the explanation the local model writes, with what it is, why it matters, and what to do.*\n\nThat percentage is the piece no text model gives me with that precision, because it did not tell me it was a rootkit, it does not talk: it calculates, and what it told me was that it was quite likely and that there was a one in five chance it was something legitimate.\n\nInvestigating both took me less than a minute, and that is the work I no longer do by hand.\n\nThe third piece does not judge, it writes.\n\nA local 27B model on my own machine served with llama.cpp takes the verdicts and writes the executive summary in Spanish plus an explanation per finding with what it is, why it matters, and what I would do right now.\n\nNone of that leaves my machine, not a finding, not a machine name, not a path.\n\nThe report that in a normal audit took me an hour of writing comes out written, in my language, and with prioritized actions.\n\nI will say it before anyone asks, this is one sample and 24 findings with 12 false positives can be a good Tuesday or it can be luck.\n\nI still need to measure calibration in Spanish, which is another language and not the same thing.\n\nI still need to count false negatives, the ones the judgment layer sends to noise that were actually real, because without that data I cannot say the layer is reliable, only that it is being useful to me.\n\nAnd I still need to take it to the log viewer, where the natural state is not findings but bursts of events.\n\nThis is what there is, a 52-tool panel that finishes in 35 seconds and a calibrated judgment layer that costs 4 euro cents.\n\nA local model that writes the report and two false alarms this setup resolved in a minute.\n\nThink about it, gentlemen.\n\nOriginally published at [https://sammideblas.com/notas/ai-verdict-layer-on-52-security-tools](https://sammideblas.com/notas/ai-verdict-layer-on-52-security-tools)", "url": "https://wpnews.pro/news/52-security-tools-one-judgment-layer-35-seconds", "canonical_source": "https://dev.to/analista_83/52-security-tools-one-judgment-layer-35-seconds-548j", "published_at": "2026-09-21 17:08:52+00:00", "updated_at": "2026-09-21 17:25:24.815707+00:00", "lang": "en", "topics": ["ai-tools", "artificial-intelligence", "ai-products"], "entities": ["Jev", "TypeSafe", "GPU-Z", "PowerShell", "Windows"], "alternates": {"html": "https://wpnews.pro/news/52-security-tools-one-judgment-layer-35-seconds", "markdown": "https://wpnews.pro/news/52-security-tools-one-judgment-layer-35-seconds.md", "text": "https://wpnews.pro/news/52-security-tools-one-judgment-layer-35-seconds.txt", "jsonld": "https://wpnews.pro/news/52-security-tools-one-judgment-layer-35-seconds.jsonld"}}