Mistrust of AI has grown as headlines about rogue agents amplify public concerns. When someone asks an AI assistant a general question, an unclear answer is a minor inconvenience. In cybersecurity, where 81% of CISOs worry that AI agents have too much access, every decision has to be defensible, which makes a clear evidence chain essential to trusting AI-enabled solutions.
When an analyst gives an Andesite agent an objective, they need to understand how the agent is reasoning and why it takes each step. They also need to be able to defend their actions later, especially if the SOC manager or CISO asks how they reached a conclusion. Evidentiary AI™ addresses both needs. As a first principle rooted in Humans at the Helm, Evidentiary AI™ isn’t a single feature but a philosophy that guides how we build our product and how we work.
Our philosophy starts with the work and needs of the people who rely on our product, from junior analysts to CISOs, and the organizations they protect. With them in mind, Evidentiary AI™ has two parts. First, the agent has to reason well: it should be analytical, steerable, and responsive to user feedback. Second, it has to present that reasoning in a way users can follow.
What We Mean by Evidentiary AI™
Evidentiary AI™ reflects our commitment to transparency and traceability. Audit logs, which can be downloaded and reviewed at any time, record high-level system and user actions, giving teams what they need to investigate incidents and maintain data integrity and regulatory compliance. Planning mode shows which data sources an agent will use before it runs a potentially costly query. Now we’re extending that transparency beyond planning to any question an analyst asks the agent.
Andesite supports many SOC workflows, from grouping and dispositioning alerts to creating agents and playbooks. One of them is working with an agent to investigate threats across connected data sources. Without visibility into the agent’s reasoning, an AI-driven investigation can feel like a black box, which runs counter to one of our core principles.
Analysts are accountable for every call they make, and not seeing how the agent reached an answer adds stress instead of reducing it. We set out to make what the agent is doing visible, easy to follow, auditable, and easy to explain to others. That is the purpose of Evidentiary AI™.
Agent Reasoning: Is It Sound?
Analysts want to understand how our agent works through an investigation, including the questions it asks itself to reach a conclusion. What hypotheses could explain this activity? What evidence supports or contradicts each one? Which hypothesis does the evidence support best, and which alternatives are still open? Has new information come in that changes the picture? Does an explanation fit the context, such as the results of a query to a specific connector? And if an analyst proposes an explanation, does the evidence support it?
Our agent uses a reasoning structure to make sure its conclusions are backed by evidence. It forms hypotheses, collects claims that support or contradict each one, and ties every claim to the results of a specific query to a connected source. The goal is a clear, analytical path that also accounts for anything the SOC team adds along the way. Evidentiary AI™ connects here to our guiding principle: Humans at the Helm. However capable the agent is, analysts have real-world context the agent doesn’t.
User Understanding: Is It Clear?
For SOC analysts, investigative accountability hinges on understanding the decisions made by the agent. At Andesite, we want users to be able not just to see the evidence, but to follow it. That’s why we focus on how the agent presents evidence in the chat. That’s why we created a dedicated evidence panel that presents the actual information the agent finds in an organization’s logs and data alongside the claims it makes. It’s the difference between “This is what Andesite did, but I can’t tell you why,” and being able to say, “Here’s why the agent made this claim, or why the evidence contradicted its first hypothesis.”
Rethinking AI Hallucinations
Much of today’s mistrust of AI stems from the belief that models frequently hallucinate — a concern often raised by our customers. When an agent gives an unexpected answer, or one that doesn’t match a user’s understanding of their data, it’s natural to suspect a hallucination. In practice, hallucinations are rare in Andesite, and we measure the quality of agent responses with every release.
Here is the disconnect: an unexpected or incorrect answer isn’t necessarily a hallucination. There are many reasons an agent might fail to respond as expected. It could have drawn a reasonable conclusion from the data without showing how it got there. For example, it might flag unusual login patterns without explaining what makes them unusual. It may have queried the wrong dataset, or the right one in a way that missed important information. The data itself may be incomplete, or the agent may not have access to everything it needs. In those cases, the agent can come across as overconfident, presenting one plausible explanation as fact. Whatever the cause, the underlying issue is usually the same: users can’t see how the agent arrived at its answer.
Evidentiary AI™ closes that gap. Our tested methodology improves how the agent reasons, and our evidentiary record improves how that reasoning is presented. Analysts can see and verify each choice the agent makes along the way. That visibility helps ease concerns about hallucination, and the better analysts understand the agent’s reasoning, the better they can steer it.
Making the Experience Better for Customers
AI gives us powerful technical capabilities, but they’re only as valuable as our ability to make them accessible and useful to the people who rely on them. That’s why understanding analysts and their needs shapes how we design the experience.
Security work is demanding, and adopting new AI tools can add pressure. Our goal is to give analysts confidence in the work they’ve done and the conclusions they’ve reached. We keep looking for ways to make the agent’s reasoning easier to see and explain, so analysts can tell the story of any investigation.
Evidentiary AI™ is a core part of our product philosophy, woven into how Andesite works. Without it, analysts couldn’t trust the agent’s work or defend their own. In the Human-AI SOC, analysts need to see and understand what the agent plans, what it executes, and how it reaches its conclusions. Evidence builds that trust and gives analysts the framework they need to make critical decisions.