Give AI The Evidence It Needs

The best way to reduce unnecessary AI token use is not always to make the model process information faster.

It is to stop sending the model evidence it does not need.

Security environments produce enormous volumes of telemetry.

Endpoints, identities, networks, cloud services, applications, and security platforms continuously generate information about events occurring across the enterprise.

That information is essential to security operations.

But more data does not automatically create a better investigation.

When raw alerts, duplicate events, and irrelevant logs are passed into an AI workflow, they can increase prompt size, processing requirements, and investigative noise.

The model may spend additional resources processing information that contributes little to the security decision.

HAWK designed ClaimKit around a different operating principle:

Give AI the evidence it needs—not everything you have.

Why AI Security Investigations Need Focused Evidence

Traditional security investigations often require analysts to gather information from disconnected tools.

An endpoint alert may identify suspicious execution.

Identity logs may provide authentication context.

Network telemetry may show communication with external infrastructure.

Cloud events may reveal additional activity involving the same identity.

Threat intelligence may help explain whether observed behavior is associated with known malicious activity.

The investigation requires information from those sources.

But it does not necessarily require every event those sources contain.

The objective is to identify the evidence relevant to the specific security question.

That distinction becomes important when AI is used to reason across large volumes of security information.

Unfiltered telemetry can introduce unnecessary context, duplicate observations, and unrelated activity.

Focused evidence can make the investigation more efficient by reducing the amount of information the model must process.

The goal is not simply less data. It is the right evidence, available when the decision needs to be made.

How ClaimKit Supports Evidence-Driven AI Investigation

ClaimKit is HAWK's evidence-intelligence technology.

It identifies, normalizes, extracts, and cites evidence relevant to a security investigation before Octopus cAI reasons across that information.

Rather than passing an entire collection of logs and alerts into the AI workflow, ClaimKit focuses the evidence available for investigation.

The intended result is a more relevant and traceable information set.

This matters because security conclusions need to be supported by evidence.

A finding should not depend only on a generated explanation.

Security teams need to understand what observations support the conclusion, where the information originated, and how it relates to the event being investigated.

Focused, citable evidence supports that process.

ClaimKit and Octopus cAI therefore serve distinct roles within HAWK's architecture.

ClaimKit focuses the evidence.

Octopus cAI reasons across that evidence to investigate and validate security activity.

Together, they support an evidence-driven approach to autonomous security investigation.

ClaimKit Benchmark: Prompt-Token Reduction and Investigation Accuracy

HAWK's published ClaimKit benchmark illustrates the relationship between focused evidence, AI processing requirements, and investigation accuracy.

The benchmark reports three notable results.

Average Prompt Tokens: 363 to 43

Average prompt-token usage decreased from 363 to 43 in the reported comparison.

This represents a substantial reduction in the amount of information sent for model processing.

The result is consistent with ClaimKit's approach of selecting relevant evidence instead of supplying larger volumes of unnecessary context.

88% Lower Prompt-Token Usage

The benchmark reports an 88% reduction in prompt-token usage.

This describes processing efficiency within the measured benchmark.

It should not be interpreted as an automatic 88% reduction in total AI operating expenses.

Actual costs can also include model outputs, tool execution, evidence retrieval, infrastructure, and human validation.

97.4% Benchmark Accuracy Versus 26.2% for Traditional RAG

HAWK's benchmark reports 97.4% accuracy for ClaimKit, compared with 26.2% for the traditional retrieval-augmented generation (RAG) approach evaluated in the same benchmark.

This comparison illustrates the importance of evidence selection and relevance within the reported test.

The results describe the benchmark conditions and should not be interpreted as universal accuracy figures for all security investigations or all RAG implementations.

What the Benchmark Results Mean for Security Operations

The central lesson is not simply that fewer tokens were used.

It is that evidence selection can influence both processing efficiency and the quality of information available to the AI system.

An investigation does not necessarily become more reliable by adding every available event to the prompt.

Irrelevant or duplicate information can increase the amount of material that must be processed without contributing meaningfully to the conclusion.

A more focused evidence set can reduce unnecessary processing while preserving the information needed for reasoning.

The quality of the result must still be evaluated.

For security operations, efficiency is valuable when it helps the organization reach a supported decision without sacrificing evidence quality.

Token Efficiency Is Not the Same as Total Investigation Cost

Reducing prompt-token consumption can lower one component of AI processing expense.

But a security investigation has broader operational costs.

These may include:

• Retrieving and preparing investigation evidence

• Executing AI model requests

• Calling connected tools and services

• Validating generated findings

• Correcting incomplete or inaccurate conclusions

• Escalating consequential decisions

• Executing and verifying authorized response actions

A workflow that uses fewer tokens but requires substantial analyst rework may not provide a lower total investigation cost.

Similarly, a more computationally intensive workflow may be justified if it materially improves the quality and timeliness of the resulting security decision.

The appropriate economic measure is therefore broader than token consumption alone.

AI efficiency should be evaluated by the cost and effort required to reach a validated security outcome.

Why Evidence Quality Matters More Than Evidence Volume

Security operations depend on reliable conclusions.

A suspicious process, unusual authentication event, or unexpected network connection may provide an important signal.

But that signal must be evaluated alongside other relevant observations.

The investigation needs to establish what happened, which systems and identities were involved, whether the activity is malicious, and what response may be justified.

Adding unrelated telemetry does not necessarily improve those answers.

Effective evidence selection should preserve information that supports the investigation while reducing unnecessary processing.

That requires more than simply shortening an AI prompt.

The system must retain evidence relevant to the security question, including information that may confirm or challenge a potential conclusion.

An efficient investigation should therefore be both focused and defensible.

Less evidence is not automatically better. Better-selected evidence is.

Connecting ClaimKit Evidence to Octopus cAI Investigation

HAWK Security Operations Automation connects focused investigation evidence with coordinated, policy-governed response across the security operation.

Within HAWK's technology architecture, ClaimKit and Octopus cAI perform complementary functions.

ClaimKit identifies and prepares relevant investigation evidence.

Octopus cAI uses that evidence to support autonomous investigation, reasoning, and validation.

This approach reflects a broader principle in AI-driven security operations:

The AI system should receive the evidence necessary to answer the investigation question rather than an indiscriminate collection of available telemetry.

A focused evidence set can help reduce unnecessary model processing.

It can also make the supporting information easier to examine, trace, and validate.

The result is an operating model designed around meaningful security evidence instead of data volume alone.

Why Focused Evidence Can Reduce Investigation Friction

Security investigations often slow down when analysts must repeatedly move between disconnected systems.

An endpoint tool may contain one observation.

An identity platform may provide another.

Network logs may establish related activity.

Cloud telemetry may contain information relevant to the affected account.

When those observations are difficult to connect, analysts spend time gathering and validating context instead of evaluating the security decision.

An evidence-driven workflow seeks to reduce that friction.

Relevant information is assembled earlier.

Supporting evidence can be made available for review.

AI reasoning can focus on the specific investigation.

And analysts can spend more time examining findings that require judgment.

These are potential operational benefits of focused evidence. Actual improvements in analyst effort or investigation duration should be measured in the deployed environment.

What Security Leaders Should Measure

Organizations evaluating AI-assisted security investigation should look beyond model usage alone.

Useful measurements include:

Prompt-Token Consumption

How much input information does the AI workflow process for a defined investigation task?

Evidence Relevance

Does the investigation include the information necessary to establish what happened while avoiding unnecessary unrelated data?

Investigation Accuracy

How consistently does the workflow reach conclusions supported by the available evidence?

Analyst Validation Effort

How much manual work is required to confirm or correct the investigation?

Time to a Validated Finding

How long does it take to move from the initial signal to a supported determination?

Cost per Validated Outcome

What is the total measured processing and operational cost of producing a finding that meets the organization's validation requirements?

These measures help security leaders distinguish between inexpensive model processing and genuinely efficient security operations.

HAWK's Approach: Give AI the Evidence It Needs

HAWK's ClaimKit approach is built around the principle that evidence relevance matters more than evidence volume.

Security environments generate large amounts of useful information.

But investigations need the evidence associated with the event being evaluated.

ClaimKit focuses that evidence before Octopus cAI reasons across it.

HAWK's published benchmark illustrates the potential efficiency of that approach through reduced prompt-token usage and improved accuracy within the reported test conditions.

The objective extends beyond lower processing requirements.

It is to support investigations grounded in relevant evidence, with a clearer basis for validation and subsequent security decisions.

AI efficiency begins before the prompt.

It begins with deciding what information the AI actually needs.

The right evidence. Less noise. Faster answers. Stronger security operations.