AI investigation quality · Demonstrated in the results
Not all AI SOCs and AI SIEMs deliver the same quality of analysis. Choose a company whose quality is demonstrated in its results. Here, two AI techniques investigated the same 253 cases—and reached different verdicts with real consequences.
See the evidence. Then evaluate Fluency on your own data.
No credit card · Your own Fluency site · Start with Microsoft 365
Swarm tier one results · The 253-case run shown in the video
The detailed workflow comparison covers nine published cases. Those examples are a subset of the 253-case run, not a full-run workflow accuracy measure.
Quality demonstrated. Improvement ongoing.
Fluency’s customers deserve the best analysis we can deliver today. We actively analyze and compare AI techniques using real data and real incidents, examining the evidence they find, the verdicts they reach, and the actions they recommend.
We keep testing and improving rather than simply repeating what worked yesterday. This is results-based research: hold the cases and detection front end constant, compare the investigations, and use what the evidence reveals to improve the work customers receive.
Judge investigation quality by the results. Start a trial and examine the evidence, conclusions, and recommendations in your own environment.
Why the verdict matters
The consequential miss
In the published cases, the workflow escalated seven of nine and closed the most dangerous one: a Global Administrator who granted their own application permission to read, write, and send on every mailbox.
A useful investigation must explain the permissions, the scope, and why the activity is safe or requires action.
Fluency’s behavioral analytics compare users and hosts with their own history. Related alerts become cases ranked by certainty. Investigation then determines what the evidence means.
In this comparison, the three highest-scoring cases closed benign. The confirmed password attack scored 10,400. Risk score and verdict answer different questions.
How Fluency builds a case →Password attack
18 failed passwords from nine residential addresses in four countries, in under seven hours. The investigation brings the activity together.
Dropper
A file hash linked the dropper to another host and 23 unmitigated detections. The original alert was the starting point for scoping.
Inbox rule
The rule was the tenant’s only external forward in 30 days. Historical context changes how the activity should be assessed.
The video follows the work into tier three: compare playbook advice with a response written for the specific incident. Evaluate whether the recommendations follow from the findings.
Your 30-day evaluation
Start with Microsoft 365 and your own Fluency site. Connect and verify your source, investigate available evidence, and review the result in Companion.
Free for 30 days. No credit card required.
After the trial, SMB pricing starts at $7 per user per month with a $75 monthly minimum. One year of retention is included. See pricing.
Provision your own Fluency evaluation environment. Start with Microsoft 365; onboarding depends on your access and source requirements.
Work through available cases, or ask a coverage or health question. Connect Claude or Codex to Fluency’s governed MCP capabilities.
Bring the investigation or report into Companion. Check the evidence, the scope, and the recommended next actions with your team.
The same Fluency foundation supports health reviews, coverage analysis, posture assessments, and reporting. Companion gives your team a place to use the work; governed MCP capabilities let Claude and Codex investigate within your permissions and customer scope.
Explore Companion and AI access →
