Configurable autonomy framework

You control how much AI automates.

FortMind's 6-level autonomy framework lets you configure exactly how much decision-making control you give to AI—from Level 0 (fully manual) to Level 5 (fully autonomous). Start cautious, scale with confidence.

Book a demoSee how it works

The autonomy spectrum.

Six distinct levels—from fully manual to fully autonomous. Configure globally or per alert type. Change anytime.

0-5Autonomy levels
85Default confidence gate
Per-alertGranular settings
0

Manual

No risk

1

Assisted

Very low

2

Suggested

Low

3

Semi-auto

Medium

4

Conditional

Medium-high

5

Autonomous

Managed

No automation
AI assists
AI acts (approval required)
Fully autonomous

Each level explained.

Understand what AI does automatically, what requires approval, and who each level is best for.

00

Level 0: manual operations.

No automation

AI performs zero actions. Analysts do everything manually, just like traditional SOC operations.

What AI does

  • Nothing—AI is completely disabled
  • Alerts appear in queue unchanged
  • No enrichment, triage, or investigation

What analysts do

  • Manually triage every alert
  • Query tools manually for enrichment
  • Decide and execute all response actions

Best for: Highly regulated industries testing FortMind for the first time, or organizations with strict change control policies requiring gradual adoption.

01

Level 1: assisted operations.

Very low risk

AI enriches alerts and provides recommendations, but takes no actions. Analysts still make all decisions.

What AI does

  • Yes:Enriches alerts with threat intel (VirusTotal, AbuseIPDB)
  • Yes:Suggests triage priority (High/Med/Low/False Positive)
  • Yes:Recommends next investigation steps
  • No:Does NOT execute any actions

What analysts do

  • Review AI enrichment and recommendations
  • Approve or override triage suggestions
  • Manually execute all response actions

Example scenario

Alert: "Suspicious login from 203.0.113.45" → AI enriches with VirusTotal (malicious), AbuseIPDB (reported for brute force), suggests "High Priority" → Analyst reviews, agrees, manually blocks IP in firewall.

Best for: Teams new to AI/automation, wanting to see recommendations before granting execution permissions. Ideal for gaining confidence in AI accuracy.

02

Level 2: suggested actions.

Low risk

AI recommends specific response actions (e.g., "Block this IP"), but waits for analyst approval before executing.

What AI does

  • Yes:Everything from Level 1 (enrichment, triage)
  • Yes:Proposes specific actions ("Block IP in firewall")
  • Yes:Drafts actions in UI with "Approve" button
  • No:Waits for analyst approval before execution

What analysts do

  • Review AI's proposed actions
  • Click "Approve" (or "Reject") for each action
  • AI executes only approved actions

Example scenario

Alert: "Malware detected on WIN-SRV-01" → AI suggests: "Isolate endpoint, Quarantine file, Create ticket" → Analyst reviews, clicks "Approve All" → AI executes all 3 actions via EDR API and ticketing system.

Best for: Teams comfortable with AI triage but want final approval before actions execute. Speeds up response time while maintaining control.

03

Level 3: semi-autonomous.

Medium risk

AI automatically executes low-risk actions (create tickets, enrich data), but asks approval for high-risk actions (block IPs, isolate endpoints).

AI does automatically

  • Yes:Create incident tickets
  • Yes:Enrich alerts with threat intel
  • Yes:Query logs and SIEMs for context
  • Yes:Send email notifications
  • Yes:Close confirmed false positives

Requires approval

  • Approval required:Block IPs/domains in firewall
  • Approval required:Isolate endpoints
  • Approval required:Quarantine files
  • Approval required:Disable user accounts
  • Approval required:Modify firewall rules

Example scenario

Alert: "Phishing email clicked by user123" → AI automatically: Creates ticket, queries email logs, enriches URL (malicious) → AI asks approval: "Block domain in proxy?" → Analyst approves → AI executes block.

Best for: Most organizations. The AI investigates and recommends; you approve the actions that change state. Balances speed and control.

04

Level 4: conditional autonomy.

Medium-high risk

AI executes all actions automatically if confidence is high, but asks approval for cases that fall below your confidence threshold.

AI does automatically

  • Yes:All Level 3 actions (tickets, enrichment, queries)
  • Yes:Block IPs/domains (if confidence ≥ 85%)
  • Yes:Isolate endpoints (if confidence ≥ 85%)
  • Yes:Quarantine malware (if confidence ≥ 85%)
  • Yes:Close confirmed false positives

Asks approval when

  • Conditional:Confidence < 85% (uncertain case)
  • Conditional:Action affects critical systems
  • Conditional:Conflicting evidence in investigation
  • Conditional:New attack pattern (no historical data)

Example scenario

High Confidence (92%): Alert: "Known ransomware IOC detected" → AI automatically isolates endpoint, quarantines file, creates ticket → Notifies analyst after completion.

Low Confidence (74%): Alert: "Unusual PowerShell execution" → AI investigates, finds mixed signals → Asks analyst: "Isolate endpoint? (74% confidence)"

Best for: Mature SOC teams with high trust in AI. Want speed for clear-cut cases, human oversight for edge cases. Typical for 24/7 operations.

05

Level 5: fully autonomous.

Managed autonomy

AI operates autonomously for cases that clear your confidence threshold. Investigates, decides, and executes all response actions without routine human approval. Low-confidence edge cases auto-escalate to analysts.

AI does everything

  • Yes:Receives alert, triages automatically
  • Yes:Investigates using all available tools
  • Yes:Decides severity and response plan
  • Yes:Executes all containment actions
  • Yes:Creates tickets, documents findings
  • Yes:Notifies analysts after completion

Analysts review post-action

  • Handle escalations for low-confidence cases (<95%)
  • Review completed investigations in dashboard
  • Audit AI decisions and reasoning
  • Provide feedback (correct/incorrect)
  • Focus on threat hunting and strategy

Built-in safety mechanisms

  • Action rate limits (max X per hour)
  • Critical system protection (prod servers)
  • Rollback capability (undo reversible actions)
  • Irreversible actions downgrade to Level 4 (approval required)
  • Real-time audit logs (immutable)
  • Circuit breaker (pause if >3 isolations in 10 min)
  • Override button (humans can intervene)

Example scenario

Alert: "Ransomware detected on FILE-SRV-03" → AI investigates (queries EDR, checks lateral movement, identifies IOCs) → AI decides: "High severity, contain immediately" → AI executes: Isolates endpoint, quarantines files, blocks C2 IPs, creates ticket, notifies on-call → Analyst reviews 10 minutes later, confirms correct response → Incident resolved without waiting for an analyst to pick it up.

Best for: Highly mature SOC teams, organizations with understaffed security, after-hours/weekend coverage, or those wanting to take tier-1 fully off the queue. Requires Shadow Mode validation — review a body of simulated decisions and satisfy yourself with the accuracy — before activation.

Side-by-side comparison.

Quick reference guide to help you choose the right autonomy level for your team.

CapabilityL0 — level 0, manualL1 — level 1, assistedL2 — level 2, suggestedL3 — level 3, semi-autoL4 — level 4, conditionalL5 — level 5, autonomous
Alert enrichmentNoYesYesYesYesYes
AI triageNoYesYesYesYesYes
Action recommendationsNoSuggestSuggestSuggestAutoAuto
Create ticketsManualManualApprovalAutoAutoAuto
Block IPs and domainsManualManualApprovalApprovalIf ≥ your thresholdIf ≥ your threshold
Isolate endpointsManualManualApprovalApprovalIf ≥ your thresholdIf ≥ your threshold
Quarantine filesManualManualApprovalApprovalIf ≥ your thresholdIf ≥ your threshold
Escalates below your thresholdNot applicable — no AI actions at level 0AlwaysAlwaysAlwaysAlwaysAlways
Audit trail, with reasoningNot applicable — no AI actions at level 0CompleteCompleteCompleteCompleteComplete

The last two rows are identical from Level 1 up, and that is the point: raising autonomy changes which actions run without you. It does not change that a case below your confidence threshold goes to a human, or that every step is logged with the reasoning behind it. Level 0 is dashed because nothing runs there at all.

Recommended path (Shadow Mode validation)

Start at Level 1-2 (build confidence in AI accuracy) → Move to Level 3 → Before activating Level 4, run it in Shadow Mode (AI simulates actions, you review 50+ decisions) → Activate Level 4 once the shadow log meets your accuracy bar → Graduate to Level 5 using same Shadow Mode validation. Most organizations operate at Level 3-4 long-term.

Configure & control.

Granular controls let you set autonomy per alert type, per integration, or globally. Change anytime.

Granular configuration.

Set different autonomy levels for different alert types or integrations.

Malware alerts

Known malware → Fully autonomous (high confidence, low risk)

Level 5

Lateral movement

Suspicious internal traffic → Approval for containment

Level 3

VIP user alerts

Executive accounts → Always ask before acting

Level 2

Prod database alerts

Critical systems → Only enrich and suggest, never auto-act

Level 1

Risk management.

Built-in safeguards ensure AI stays within bounds, even at Level 5.

Action rate limits

Max X blocks/isolations per hour. Prevents runaway automation.

Protected assets

Tag critical systems (prod DBs, domain controllers) as "approval required."

Rollback capability (reversible actions)

One-click undo for reversible actions (unblock IP, un-isolate endpoint). Irreversible actions (wipe device, rotate root keys) always require Level 4 approval logic.

Circuit breaker (default: >3 isolations in 10 min)

Auto-pause if error rate spikes or if >3 hosts are isolated in 10 minutes (prevents "flash crash" mass-quarantine scenarios).

Override button

Analysts can stop or reverse any AI action at any time.

Immutable audit logs

Every AI decision and action is logged with reasoning (compliance-ready).

Start at your comfort level. Scale when ready.

FortMind grows with your trust. Begin with Level 1 (assisted), graduate to Level 3 (semi-autonomous), validate with Shadow Mode, then reach Level 5 (high-confidence autonomy). You're always in control.

Book a demoSee platform overview

Change autonomy levels at any time. No lock-in.