Decision Models Cut SOC Triage to $100/Year but Fail on Endpoint Context

New System One decision models from TypeSafe, OpenAI, and Cribl output fixed-schema verdicts with calibrated probabilities instead of text. SOC teams can threshold alerts at 0.97 for auto-close or 0.6 for escalation while logging every choice for replay. The approach removes the economic case for cherry-picking high-severity items only. Evidence from 25 million alerts processed in 2025 shows the models receive incomplete inputs: 82,000 memory scans occurred, 2,600 machines were infected, and over half carried false mitigation status. Severity labels alone produced 54 real incidents from the lowest tier. Calibration holds only across alerts sharing identical titles and severities; host-level telemetry is absent. Cribl's model card notes overconfidence when prompt wording shifts. Procurement records and vendor pricing confirm the cost drop, but integration contracts reveal no requirement for richer endpoint state. Platforms that feed only alert metadata will automate the wrong decisions at scale. Next quarter will show whether SOC vendors add memory-scan and process-tree fields to decision prompts or continue relying on EDR status flags.