Teaching AI to Reason Through Detection Triage

August 17, 2026

Every security alert begins with a deceptively simple question: Is this a real threat or just noise? Detection triage sits at the front of the response lifecycle, where answering this question quickly and accurately can determine what gets investigated, prioritized, or safely closed.CrowdStrike’s NVIDIA Nemotron-powered detection triage models already answer this question at machine speed, reading a detection and producing a true positive (TP) or false positive (FP) verdict with a calibrated confidence score. But experienced analysts do more than arrive at a verdict. Theyreasontoward weighing evidence across command lines, behavioral context, and other signals to understand not only what happened, but why it matters.

So we taught our triage model to do the same. Our latest research paper,“Cybersecurity Detection Classification with Reasoning-enabled Language Models”(Khannaet al., July 2026) which supports theOpen Secure AI Alliance, trains a CrowdStrike Charlotte AI™ triage classifier to reason through a detection step by step, and produce a transparent chain of reasoning, before it commits to a verdict. The result is more accurate triage, more detections that can be safely automated, and a rationale that SOC analysts can read, evaluate, and trust.

Below are the broader lessons from our findings:

The conventional approach to LLM-based triage asks the model to read a detection and output a label directly. This is fast and scalable, and produces a usable confidence score; however, it treats a reasoning-driven task as an instinctive response.

Chain-of-thought reasoning changes that. Before deciding, the model works through the evidence in the detection: what the process is doing, where it came from, whether the parent-child process chain looks legitimate, and how the pieces fit together. This reasoning trace empowers better verdicts and provides an auditable explanation that an analyst can review, turning an opaque label into a decision they can stand behind.

Getting a model to reason well about real detections took a four-stage training recipe, each stage building on the last:

The payoff shows up where it matters most: at the high-confidence operating point that governs automated triage. At this tier, detections can be auto-closed or prioritized with minimal analyst intervention, so higher recall here translates directly into more workload removed from the queue. Compared to the direct-label approach, the reasoning-enabled system surfaces dramatically more actionable detections at the same high precision.

This 43.0 percentage point increase in high-confidence false positive recall means far more benign alerts can be automatically and safely closed, while the 18.3 percentage point gain in true positive recall means more genuine threats can be prioritized for analysts.

Just as striking iswhatdelivers this performance. The reasoning system reaches 82.6% overall accuracy, well above every off-the-shelf model we tested, including frontier general-purpose models many times its size. In our comparisons, leading general-purpose models clustered around 55% to 71% accuracy on this task, roughly in line with an untrained NVIDIA Nemotron 3 Nano 30B-A3B model and well below the fine-tuned result.

The lesson is one we've seen repeatedly: For a specialized domain like triage, targeted training on real detection data can outperform raw scale. This success highlights the power and usefulness of open models. Leveraging highly capable open models provides the flexibility needed to build purpose-driven AI that can outperform much larger, closed alternatives on specialized tasks like detection triage.

Try CrowdStrike free today

Sign up now to receive the latest notifications and updates from CrowdStrike