---
title: "IT and security: alerts classified with evidence"
description: "Duale AI agents investigate each alert, event, or incident and return a category, severity, and recommended action with every finding linked to its source."
lang: en
lastUpdated: 2026-10-23
url: https://duale.ai/en/use-cases/it-and-security
---

<Hero
  eyebrow="IT and security"
  title={
<>
  AI agents for IT and security, <AccentText>each alert investigated and classified, with its evidence.</AccentText>
</>
}
  subtitle="Your analysts start each alert, event or incident from the evidence. Duale AI reviews each one and returns the result in the format you set, with every finding linked to its source. One Task splits the work into focused branches and runs in the background."
  primaryCta={{ label: "Plan your first use case with us", dialog: "contact" }}
  secondaryCta={{ label: "See pricing", href: "https://duale.ai/en/product/pricing.md" }}
/>

<Section title="Alert triage, a severity and a recommended action for each new alert" subtitle="Your analyst reads the reasoning and each finding's source, and your code has already opened the ticket.">
  **When it starts:** your code starts one Task for each new alert.

  **How the Task splits it:** three branches. The first gathers the evidence from your logs and security tools. The
  second reads the public advisories on the affected software. The third checks the recent changes on the affected
  machine. Each branch reaches your systems through [Tools](https://duale.ai/en/product/tools.md), and
  [Model routing](https://duale.ai/en/product/model-routing.md) runs it on a model you enabled.

  **You get back:** the category, the severity and the reasoning behind them, each piece of evidence with its source, and
  a recommended action. Your code opens the ticket.

  **Illustrative example: an alert on a finance team account at 02:14.**

  | Item               | Finding                                                                        | Source                      |
  | ------------------ | ------------------------------------------------------------------------------ | --------------------------- |
  | Category           | Suspected account takeover                                                     | The three findings below    |
  | Severity           | High: the finance share holds payroll files                                    | Your asset inventory        |
  | Sign-in            | First sign-in to this account from a new country, at 02:14                     | Identity provider log       |
  | Activity           | 3,200 files read on the finance share in six minutes                           | File server audit log       |
  | Device             | The employee's laptop was switched off at that time                            | Endpoint protection console |
  | Recommended action | End the account's sessions and reset its password; your code opened the ticket | Your service desk           |

  **Your analysts decide:** containment, closure or escalation.
</Section>

<Section title="Watch each reading and camera image, and act on your rules" subtitle="Once each event is checked, your code takes the action, such as opening a ticket.">
  **When it starts:** your code starts one Task for each event, or on the schedule you set. An event can be a new alert
  from a feed, a reading out of range or a new image.
  [See how your code starts a Task](https://duale.ai/en/docs/sdk.md#submit-a-typed-task-request).

  **How the Task splits it:** focused branches read the event and compare it with earlier events and your rules. When a
  rule is met, they call your code, for example to open a ticket. For an image, your code adds it to a
  [Library](https://duale.ai/en/product/libraries.md). An image-capable model you enabled then examines it.

  **You get back:** for each event, a short status note against your rules, with what was found, its source, and the
  action your code took or proposes.

  **Illustrative example: two events in one evening.**

  | Event                                                         | What the Task found                                                                                     | What your code did                                                        |
  | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
  | Server room B reads 31 °C, above your 27 °C limit             | The temperature rose over 40 minutes; cooling unit 2 reports a fan fault; no maintenance is planned     | Opened an urgent ticket for facilities, with the readings and the fault   |
  | The camera at the server room door sends a new image at 21:05 | The door is propped open by a cart, with no one in view; the last badge entry was a contractor at 19:42 | Opened a ticket for the security desk, with the image and the badge entry |

  **Your team decides:** the fixes, and which actions your code may take on its own and which wait for a person.
</Section>

<Section title="Incident review, one timeline and one root cause, with evidence" subtitle="Walk into the post-incident review with the causes set aside and why, and a suggested owner for each action.">
  **You hand over:** "Build the timeline and find the root cause of the customer portal outage between 14:00 and 15:00, for
  Friday's review."

  **How the Task splits it:** one branch per source, such as your monitoring data, your change records and the incident
  tickets. The Task merges what they find into one timeline. A review branch then tests each candidate cause against that
  evidence and sets aside any cause it does not support.

  **You get back:** the timeline, the root cause with its evidence, the causes set aside and why, and the actions to take
  with a suggested owner for each.

  **Illustrative example: a 47-minute outage of the customer portal, ready for Friday's review.**

  | Time       | Event                                                        | Source                              |
  | ---------- | ------------------------------------------------------------ | ----------------------------------- |
  | 14:02      | Release 4.18 of the customer portal goes live                | Deployment history                  |
  | 14:09      | Database connections reach their limit; 38% of requests fail | Monitoring data                     |
  | 14:21      | Incident opened; the first responder restarts the portal     | Incident ticket                     |
  | 14:49      | Release 4.18 rolled back; failed requests return to normal   | Deployment history, monitoring data |
  | Root cause | Release 4.18 cut the database connection pool from 50 to 10  | Change record for release 4.18      |
  | Set aside  | Network fault: no packet loss recorded during the incident   | Monitoring data                     |

  **Your team decides:** which actions to take, who owns each one, and what to share with the teams affected.
</Section>

<Section title="The capabilities behind each investigation" subtitle="Each one is set up once on the Platform and serves your other use cases too.">
  <CardGrid columns={2}>
    <Card title="Tools" icon="code" href="https://duale.ai/en/product/tools.md">
      Every change in your systems goes through your own code, from opening a ticket to ending a session. Web research
      reads the public advisories.
    </Card>

    <Card title="Libraries" icon="reader" href="https://duale.ai/en/product/libraries.md">
      Keep your asset inventory, architecture documents and the images your code adds in Libraries. Each Task cites the
      passage or the image it used.
    </Card>

    <Card title="Identity and access" icon="id-card" href="https://duale.ai/en/product/identity-and-access.md">
      Your security agent reaches only the systems you grant it, and other teams' agents never reach its findings.
    </Card>

    <Card title="Usage analytics" icon="bar-chart" href="https://duale.ai/en/product/usage-analytics.md">
      Follow each alert's Task step by step in the Dashboard Task view, with each branch's Tools and model cost.
    </Card>
  </CardGrid>

  [See all use cases](https://duale.ai/en/use-cases.md).
</Section>

<Section title="Before your first investigation" subtitle="The facts your finance and procurement colleagues check.">
  <CardGrid columns={3}>
    <Card title="One fixed price per Task" icon="check">
      A standard Task costs €0.10 and a fast Task €0.20, excluding VAT, whatever the number of branches or the duration.
      [See pricing](https://duale.ai/en/product/pricing.md)
    </Card>

    <Card title="Your providers, your contracts" icon="layers">
      Your model providers bill you directly for inference.
    </Card>

    <Card title="Your choice of hosting" icon="globe">
      Use the managed service, hosted in the European Union, or run the Platform in your own infrastructure.
    </Card>

    <Card title="Encrypted storage" icon="lock-closed">
      All stored data is encrypted, from Library files to database backups.
    </Card>

    <Card title="Unlimited agents" icon="person">
      Add agents as your teams and use cases grow.
    </Card>

    <Card title="Your content remains yours" icon="file-text">
      Duale AI does not reuse your content to train a model. [See subprocessors](https://duale.ai/en/legal/subprocessors.md)
    </Card>
  </CardGrid>
</Section>

## IT and security questions

### Can an investigation draw on our past incidents

Yes. Each investigation compares the new alert with your post-incident reviews and cites the past case that matches.
[See how Libraries keep your reference files](https://duale.ai/en/product/libraries.md), or read [what a Task recalls from earlier
Tasks](https://duale.ai/en/docs/agent-harness/context-continuity.md#what-a-task-can-recall-from-earlier-tasks).

### Will triage follow our runbooks and severity scale

Yes. Each alert comes back in your own categories and severity levels, and each recommended action names the runbook
step behind it. [See how Libraries keep your runbooks](https://duale.ai/en/product/libraries.md).

### Which security tools can an investigation reach

The ones you connect, such as your SIEM, your endpoint protection and your service desk. [See how Tools connect your
systems](https://duale.ai/en/product/tools.md).

### Can the root-cause review read our source code and logs

Yes. The review reads the repositories and logs your own code shares with it, and calculates figures from them, such
as the error rate before and after each release. [See how Tools reach your private systems](https://duale.ai/en/product/tools.md).

<Cta title="Give your analysts the evidence before they open the alert." primaryCta={{ label: "Plan your first use case with us", dialog: "contact" }} secondaryCta={{ label: "See the due diligence Task", href: "https://duale.ai/en/use-cases/finance/due-diligence.md" }} />

## Related content

- [Customer service: calls reviewed, trends traced to accounts](https://duale.ai/en/use-cases/customer-service.md)
- [Security controls for your agent platform](https://duale.ai/en/product/security.md)
- [Sales: bids and briefs sourced before the deadline](https://duale.ai/en/use-cases/sales.md)
- [AI agents for R&D, every claim sourced before your review](https://duale.ai/en/use-cases/research-and-development.md)
- [AI agent use cases: what each team hands over](https://duale.ai/en/use-cases.md)
- [Product: Task execution and platform capabilities](https://duale.ai/en/product.md)

---

## Sitemap

See the full [Markdown sitemap](https://duale.ai/sitemap.md) for all pages.