known to one analyst written down

The reason was never written down.

svc_deploy is ours, till Thursday R-0031 · on the IT head’s word · lapses Thu 19:00

Close to half the alerts a SOC analyst opens turn out to be work the client had already approved, and your analyst closes them because she knows the client. Tacit captures that reasoning of your analysts, builds a judgement layer that starts closing them for her, and puts the reason on the record.

Book a 30-minute call Open the card index ↓

49%

of one SOC’s alerts over four years were real detections of work that was expected there.

Yang et al., USENIX Security 2024.

Clients who trust us

Your SIEM was right, the client was right, but you still lose hours every day.

The name for this is a benign positive, which is a real detection of work that was expected. It is not a false alarm, so no amount of rule tuning removes it, and in the public data it is the largest single thing in the queue. Your SIEM cannot close it either, because what closes it is something your client said, and that never reached the SIEM.

46%

of the incidents in Microsoft’s public GUIDE dataset were graded benign positive by the customers themselves.

Microsoft GUIDE dataset

87%

of rule exclusions were still in force three years after someone added them.

The Exclusion Ratchet, 2026

close it again tomorrow

Four to ten minutes every time, four analysts deciding it four ways, and nothing kept for the next shift or the next hire.

or narrow the rule, for good

The exclusion outlives the reason for it, and three years on nobody remembers what it is hiding.

It sits between your SIEM and your analysts.

Every alert passes Tacit on its way to your desk. What a reason covers is closed in your SIEM with the reason attached, what needs a person is escalated with everything Tacit read, and the rest is left exactly as it was.

A thousand alerts from one night at a made-up client, on the product’s run screen.

A trade is learned at the bench.

What makes your best analyst good is that she knows the client.
She learned it the way a shipwright does, standing beside someone who already knew.
None of it was written down, so when she moves on, or the provider changes, the desk starts again.
A model cannot guess it either, because the answer was never in the alert.
So it has to be kept: what was said, by whom, for what, until when.
Tacit is the desk’s ledger and the clerk who keeps it.

214 reasons an alert is benign.

At one client there are 214 reasons an alert can be a benign positive, and none of them sits in one place. They are spread across your analysts’ heads, the messages they trade with the client, the closure notes on old tickets and more.

Tacit captures each one as a card and keeps it, and that reasoning goes into our judgement model as well.

holds today lapses within 48 hours lapsed

Tap a card behind to pull it forward. The register is made up for illustration.

Experts think in patterns, not in steps.

An analyst does not work down a checklist when she opens an alert. She is matching it against a pattern, and for one kind of alert that pattern comes down to fourteen questions at most. Tacit finds the answer to each of them, works out from the answers how she would have closed this alert, and closes it with the reasons attached.

I’ve seen this one before

What Tacit read on alert 4133, in the console. Eleven questions and their answers, three of them large: this account from this host, all the time; this account on this target, first time; a reason on record, a planned change. Below them, 37 of 38 alerts like this were closed by the desk. Tacit suggests close.

Alert 4133: eleven questions, each answer shown as it is with nothing rolled up into a score, then what the desk did with 38 like it, then the call. One answer is orange because svc_deploy has never been on FIN-DB-03 before.

Our model can tell a good call from a habit.

This is the part that makes the rest possible. Your SIEM models the alert, and Tacit models the people who decide on it. A model that only copies analysts copies their habits too, like the one who escalates everything that arrives over the VPN. Ours reads the decisions your desk has already made, works out what moves the desk as a whole, and sets one person’s habit apart from it, so only the desk’s judgement is put to work. Nobody is shown by name.

What the alert showed

← escalateclose →

The desk, on 412 decisions

the desk, as one

one analyst, by habit

moves the desk to close moves the desk to escalate one analyst far from the desk

A made-up desk of eight analysts. Shown by team and never by name.

Closing alerts is only the first use.

What Tacit does is capture how your analysts reason. Closing the alerts your client already explained is the first thing that is good for, and it is not the only one. Two of these are in the product today and two come next.

1. Closing--benign positives.in the product

is this one fine?

Close what the client already explained.

An alert a reason covers is closed in your SIEM with the reason attached, so nobody on the desk has to open it.
2. Triage--what L2 must see.in the product

which ten matter?

Put the few that matter in front of your L2.

Out of a hundred alerts, the ten that need a senior analyst reach them in seconds, each with the case already put together.
3. Ramp-up--new hires.next

how do we decide here?

Bring a new analyst up to the desk.

A new hire learns how this desk reasons and what each client has said from the desk’s own decisions, and you can see when they are ready to take a client’s alerts alone.
4. Assurance--AI agents.next

can I trust the AI’s close?

Check an AI agent against your desk.

Every vendor now ships AI that triages for you, and most of the market checks one language model with another. We check it against a model of how your own desk decides.

a close in the product next

It watches first, then drafts, and goes live only where you say.

It starts with a two-week review of the decisions your desk has already made: which calls were sound, which alerts were escalated for no reason, and how many nobody needed to open at all. Nothing changes on your desk until you have seen it.

firstConnect, read-only.Tacit reads your SIEM, your tickets and whatever else you choose to show it. It cannot change an alert or a rule.
thenReview the history.It reads ninety days of your desk’s own decisions, so it knows how this desk decides for this client, and hands you the review.
beside youShadow.Tacit makes its call next to your analysts and writes nothing to your tools, so you can compare the two.
when you sayDrafts, then live.One kind of alert at a time, and only with your client’s approval. Any one of seven conditions sends it back to shadow.

22 in shadow: Tacit watches 9 in draft: an analyst agrees in one tap 3 live: Tacit closes, and checks a sample of its own closes

What Tacit is not.

A detector
Your SIEM does the detecting.Tacit reads what your rules raise and never writes or narrows one.
An AI analyst
Nothing is guessed.A small language model, running inside your boundary, reads the client’s message and copies their words onto the card. It never decides a close. That is done by a model you can read one answer at a time.
A score out of 100
Every answer, shown as it is.Nothing is blended into one number.
An analyst scorecard
Results are for the desk and for teams.No number is ever shown against a person’s name.
A permanent exclusion
Every reason carries the day it lapses.After that day the alert goes back to a person.
A cheaper SIEM bill
It takes alerts off your analysts.It does not cut what you ingest, and no raw logs leave your boundary.

What a design partner gets back.

A design partner runs Tacit in shadow on one client’s alerts, inside their own boundary. It is a second pair of eyes on every call the desk makes, and this is what comes back to them.

Fewer alerts on the desk.What a client has already explained is closed before an analyst opens it.
A reason behind every close.What it covers, who vouched for it and the day it lapses, all on the record.
Rules left whole.A reason lapses on its date, so nobody has to narrow a detection for good.
What the desk knows, kept.When an analyst moves on or a provider changes, what they knew about each client stays on the register, and a new analyst starts from it.

81%

of the benign positives in Microsoft’s public GUIDE data were closed, across 303,220 incidents graded by the customers themselves. At that setting, 1 in 100 true positives was closed as well.

Tacit research, 6 Nov 2026. Public data, measured against each customer’s own grade. This is not a design partner’s result.

to be entered

Our design partners’ own figures go here as they are measured. None is published yet.

Your client never has to take our word for it.

Every close is an entry in a ledger, each one sealed to the one before. Anyone you hand a record to can check it is whole, without signing in and without trusting us.

9 Noventry 2,914 of 2,9319 Dec

record: r-4133 · Northwind Finance · rdp-multi|svc-accounts
claim: Suggest close. Rests on the client’s word, R-0031 v.2.
agreed: L1, day desk, Wed 9 Dec 09:31, four checks ticked.
seal: not yet checked

Write it down before it walks out of the door.

Bring your SIEM, and tell us who runs your desk, to a thirty-minute call. We will tell you what Tacit would read first and what a two-week review of your desk’s decisions would show, or tell you it is not a fit and wish you well.

Book a 30-minute call

or write to hi@tacitlabs.ai