Improving Alert Triage and Analyst Efficiency

Executive summary

During a 30-day cybersecurity evaluation, Lyric Ai by Dominion Labs was assessed across alert processing, threat detection, investigation quality, analyst efficiency, runtime performance, and security controls.

The evaluation recorded a 98% overall task success rate across 10,000 evaluated tasks. The supplied performance report also documented 98% recall on a labeled threat-detection test set, a modeled 35% reduction in average triage time, and security safeguards designed to preserve analyst authority over response actions.

The challenge

Security operations require analysts to manage competing priorities, including alert triage, threat intelligence, incident investigation, and vulnerability analysis. Balancing these activities can limit the attention available for complex security work.

The evaluation explored whether Lyric Ai could make these workflows easier to manage while supporting consistent task execution and maintaining appropriate human oversight.

Implementation and workflow

Lyric Ai was evaluated across security analysis, threat intelligence research, incident response, and vulnerability analysis. Its AI-powered workflows and projects provided an intuitive interface for initiating and managing tasks.

A particularly useful capability was the ability to delegate investigations and alert triage within a few clicks. This allowed the practitioner to redirect attention toward more complex tasks while using Lyric Ai to support selected investigative activities.

The evaluation used a read-and-write operating mode in which analysts retained response authority. Automated containment actions remained disabled during the initial beta.

Performance results

Alert processing

The evaluation report describes a 30-day scenario involving 108,000 incoming alerts, including 27,000 grouped as duplicates or related events and 81,000 remaining after deduplication.

The report records 105,840 successful processing attempts and 2,160 failures, equivalent to a 98% processing success rate. Reported availability was 99.9%, with tested throughput reaching 450 alerts per hour.

Threat detection

A labeled benchmark comprising 1,000 malicious cases and 9,000 benign cases produced the following results:

• Recall: 98% (980 of 1,000 malicious cases detected).
• Precision: 91.6% (980 correct positive classifications out of 1,070 positive classifications).
• Specificity: 99% (8,910 of 9,000 benign cases correctly identified).
• False-negative rate: 2% (20 malicious cases missed).

These results characterize the supplied test set and should not be interpreted as universal detection rates across all environments.

Analyst efficiency

The productivity model compared an eight-minute baseline triage time with a five-minute, 12-second triage time after a modeled 35% reduction.

Across 81,000 alerts requiring triage, this equates to a reduction from 10,800 to 7,020 analyst hours, or 3,780 hours of potential capacity recovered over 30 days.

This calculation depends on the stated workload and triage-time assumptions.

Investigation quality

The report describes improvements during a learning period:

• Incident correlation accuracy increased from 88% to 96%.
• Correct severity assignment increased from 90% to 97%.
• Evidence-supported findings increased from 92% to 98%.
• Correct recommendations increased from 89% to 96%.
• Unsupported claims decreased from 4% to 1.5%.
• Previously learned capability retention was reported at 98%.

These figures provide additional measures for assessing investigation quality and consistency.

Security and operational controls

The evaluation report records zero successful unauthorized actions, zero unresolved critical integration vulnerabilities, and 100% audit-trail completeness. Simulated prompt-injection tests were reported as 99% blocked, with remaining failures identified for investigation.

Automated containment remained disabled, preserving analyst control over response actions during the initial beta.

Conclusion

The Lyric Ai beta evaluation combined a positive practitioner experience with quantitative benchmarks for alert processing, threat classification, investigation quality, and security controls.

The platform’s intuitive interface and straightforward task delegation were particularly valuable in managing competing cybersecurity priorities. The supplied report also presents a promising performance profile, including 98% task success, 98% threat-detection recall, and a modeled 35% reduction in triage time.

Together, these findings provide a structured basis for evaluating Lyric Ai’s role in AI-assisted cybersecurity workflows, with continued validation needed to establish how benchmark results translate to different operational environments.