What Is AI SRE and How Does Automated Incident Investigation Work

AI SRE is one of the fastest-maturing categories in modern engineering operations. As distributed systems grow more complex and deployment velocity accelerates, the traditional model of on-call engineers manually correlating signals across a fragmented toolchain is breaking under its own weight. This guide explains what AI SRE actually means, how automated incident investigation works in practice, what to look for when evaluating a platform, and how leading engineering teams are using tools like Resolve AI to cut investigation time, reduce operational toil, and build more resilient systems.

What Is AI SRE?

AI SRE stands for Artificial Intelligence-powered Site Reliability Engineering. At its core, it refers to the use of autonomous AI agents and machine learning to perform the work that human SRE engineers have historically done by hand: monitoring production systems, triaging alerts, investigating incidents, performing root cause analysis, and executing remediation actions. The category has moved quickly from experimental to operational in enterprise environments, with Gartner publishing its first Market Guide on AI SRE in January 2026.

Site Reliability Engineering as a discipline was pioneered by Google in the early 2000s and is built on the principle that keeping systems running is fundamentally a software engineering problem. Traditional SRE requires human engineers to investigate alerts, correlate signals across logs and metrics, identify root causes, and execute fixes. AI SRE automates these tasks using autonomous agents that can analyze millions of log lines in minutes, correlate signals across the full stack, and either recommend or execute remediation. Resolve AI, one of the most prominent platforms in this category, is built specifically around autonomous investigation and root cause analysis for production teams running complex infrastructure.

Why AI SRE Matters in 2026

The operational strain on engineering teams has intensified significantly. Modern microservices architectures generate more signals than engineers can manually process during a high-pressure incident. Traditional monitoring tools, which are often rule-based and fundamentally reactive, alert teams only after a problem has already occurred. As deployment pipelines ship dozens of changes per day across dozens of services, the gap between alert volume and human bandwidth continues to widen.

Research shows that typical enterprise teams receive 500 to 1,200 alerts per day, with only a small fraction requiring immediate action. Alert fatigue, the desensitization of on-call engineers caused by excessive volume and high false positive rates, results in missed critical incidents and on-call burnout. Alert fatigue and manual firefighting account for 58.9% of why SRE teams adopt AI-powered observability tooling, according to documented adoption analysis. Reducing MTTR and incident response time is the second-largest driver, at 24.7%.

Gartner projects that by 2029, 70% of enterprises will deploy agentic AI agents to operate their IT infrastructure, up from less than 5% in 2025. The convergence of large language models, autonomous agents, and cloud-native infrastructure has crossed a meaningful threshold: AI systems can now triage incidents, propose runbook patches, and auto-remediate a growing class of known failure modes. Resolve AI has emerged as one of the leading platforms driving this shift, raising more than $190 million in total funding and reaching a $1.5 billion valuation within 18 months of emerging from stealth.

Common Challenges in Incident Investigation and How AI SRE Solves Them

Understanding why AI SRE is gaining adoption requires understanding the specific pain points it addresses. The traditional incident response loop, which involves paging on-call engineers, opening a war room, parsing logs by hand, and escalating to specialists, was built for an era of low deployment frequency. At 100 or more deploys per day across 50 or more services, it falls apart.

Key Problems Engineering Teams Face

Alert Fatigue and Signal Noise: A constant flood of notifications from disconnected monitoring tools makes it difficult to distinguish important signals from background noise. A single incident might trigger 50 or more alerts across Prometheus, Grafana, and application performance tools simultaneously, all without shared context.

Manual Context Assembly: When an alert fires, evidence is scattered across multiple systems: logs in one tool, metrics in another, configuration changes in version control, and service dependencies in the infrastructure layer. Each system captures part of what happened, but none of them captures all of it. Engineers spend the first 15 to 20 minutes of an incident moving between Grafana, Kubernetes tooling, runbooks, and historical Slack threads just to establish context.

Slow Root Cause Analysis: Modern software incidents rarely have a single, obvious cause. Tracing an incident back to its underlying cause is a skill that takes years to build. Under on-call pressure, engineers often ship a patch to get the system back up and defer the real investigation to later, which means lessons are rarely captured.

Knowledge Silos and Institutional Loss: For most of the history of SRE, operational knowledge has lived in human heads: which services are fragile under load, which alerts are symptoms versus causes, which dependency chains have caused cascading failures before. Senior engineers leave, runbooks go stale within weeks, and new team members spend months reaching the productivity of veterans, not because they cannot learn, but because the relevant context is not documented anywhere they can find it.

Toil and On-Call Burnout: The manual, repetitive operational work of incident response has quietly colonized SRE team bandwidth. Engineers click through 8 to 12 tools per incident, page multiple colleagues into a war room for issues that could be resolved with better context, and write postmortems under time pressure after hours of reactive firefighting.

AI SRE platforms address these challenges by separating detection, triage, investigation, remediation, and escalation into distinct automated phases. That separation changes what an agent can safely do, which tools it can call, and when escalation to a human must occur. Resolve AI, for example, begins a parallel investigation automatically when an incident is opened, gathering evidence from code, infrastructure, and observability simultaneously and synthesizing it into ranked findings with explicit confidence levels. This changes what human judgment is applied to: evaluating evidence rather than gathering it.

How Automated Incident Investigation Actually Works

The best AI SRE systems follow a structured workflow that mirrors how a senior SRE thinks, but at machine speed. Understanding this workflow clarifies what separates genuine AI SRE from traditional observability tools or alert management platforms.

The Automated Incident Investigation Workflow

Phase 1: Alert Triage and Signal Correlation

An AI SRE does not treat every alert equally. When an alert fires, it acts as the first responder: correlating that signal with related alerts across services and dependencies in real time, distinguishing real incidents from system noise, and assessing severity based on potential business impact. It determines whether to escalate immediately or whether the issue can wait, and it handles the escalation routing automatically. AIOps platforms use machine learning to learn normal system behavior, correlate signals across metrics, logs, and traces, and suppress non-actionable alerts. Teams implementing this approach commonly see alert volumes drop by 90 to 95%, from thousands of daily alerts to fewer than 100 actionable items.

Phase 2: Investigation Planning and Evidence Gathering

Once a real incident is confirmed, the AI SRE plans an investigation. Rather than following a linear path, the most capable systems run multiple investigation hypotheses in parallel, validating each against live data. The agent pulls what changed around the affected service: recent deploys, commits, configuration changes, and infrastructure events. It queries logs, metrics, and traces and follows the failure through the dependency chain rather than stopping at the first correlated anomaly.

Research from ICSE 2025 demonstrates that incorporating code knowledge improves root cause localization by 28.3% over prior leading methods. This is why purpose-built AI SRE platforms that connect to both observability stacks and code repositories outperform tools that reason only about telemetry data.

Phase 3: Root Cause Identification

An AI-driven root cause analysis workflow uses artificial intelligence to ingest incident data, detect anomalies, identify probable root causes, and trigger or suggest remediation, minimizing manual intervention and resolution time. The key distinction between genuine root cause analysis and simple alert correlation is causal reasoning: the platform must determine why an incident happened, tracing cause and effect across services, rather than merely flagging metrics that moved together.

Topology-aware correlation is essential here. Service and data dependency graphs must remain current so that when a signal crosses a threshold, the investigation view highlights the most likely upstream causes and downstream effects, bringing the right logs, traces, and metrics into focus without a manual search.

Phase 4: Remediation Recommendation or Execution

Once root cause is identified, the AI SRE either recommends a concrete fix or executes a bounded remediation action. The degree of autonomy varies by platform and configuration. Some tools operate read-only, surfacing findings for human review. Others execute pre-approved, low-risk remediations such as rollbacks, restarts, or scaling actions within a defined policy envelope. The most capable platforms can generate remediation pull requests with full context, allowing engineers to review and merge rather than write fixes from scratch.

Automated verification is a critical component of responsible remediation. Agents should validate fixes against defined service level objectives to confirm that system performance meets reliability standards. If a change fails or introduces instability, the system should automatically roll back to a stable state.

Phase 5: Documentation and Post-Incident Learning

AI SRE platforms generate incident documentation automatically, capturing the full timeline, root cause, resolution, and lessons learned while the incident is still fresh. This closes the knowledge loop: the next time a similar issue occurs, the institutional knowledge is captured and accessible rather than locked in one engineer's memory. The agent captures every metric shift, diagnostic query, and infrastructure command executed throughout the lifespan of an incident, and instantly translates this into an accurate, deeply technical post-mortem report.

What to Look for in an AI SRE Platform for Automated Incident Investigation

As the AI SRE category has grown, many existing incident management and observability vendors have added AI features to their platforms and marketed them as AI SRE capabilities. Understanding the differences matters when evaluating tools for production use. The criteria below separate genuine causal reasoning from alert correlation.

Must-Have Features and Evaluation Criteria

True Root Cause Analysis vs. Alert Correlation

Look for a platform that determines why an incident happened, tracing cause and effect across services, instead of merely flagging metrics that moved together. The RCAEval benchmark, which provides 735 fault-injection cases across microservice systems, is one objective measure of investigation quality. Research using the NOFire AI benchmark shows that Top-1 accuracy rises from 29% on metrics-only inputs to 77% when logs are added, 87% when traces are added, and 89% on full multi-modal telemetry with agentic reasoning. This progression illustrates why platforms must integrate across the full signal set, not just one data type.

Cross-System Context and Stack Coverage

AI SRE tools should connect to existing observability stacks, correlate signals across logs, metrics, and traces, and surface working theories about root causes. An observability vendor's AI feature can only reason about observability data. An incident management tool's AI feature can only work within the incident record. Purpose-built AI SRE platforms that integrate across code, infrastructure, and telemetry provide fundamentally broader context.

Parallel Hypothesis Testing

The most effective AI SRE systems run multiple investigation hypotheses concurrently and validate each against live data. Specialized agents for code, infrastructure, metrics, logs, and change history run in parallel during an investigation, coordinated by an orchestrator that manages hypothesis formation and synthesizes findings across all of them.

Continuous Learning and Institutional Memory

A tool that provides the same generic analysis on day 100 as it did on day 1 is not capturing the institutional knowledge that makes experienced engineers effective. Look for platforms that build organization-specific knowledge from past incidents, runbooks, and team feedback. The best AI SRE systems operationalize institutional knowledge from past incidents and successful resolutions, learning from each investigation and encoding successful paths into reusable operational skills for future incidents.

Graduated Autonomy and Human-in-the-Loop Controls

Trust in AI systems is earned incrementally. A platform that delivers real value in alert intelligence and root cause analysis from day one and expands remediation autonomy as reliability is demonstrated gives teams a rational adoption path. As a system demonstrates consistent accuracy on specific types of incidents, teams can expand its autonomy for low-risk, well-understood remediations while keeping human oversight for high-stakes changes. Autonomy requires that the agent operate within strict, immutable execution rules and rely on secure human-in-the-loop validation for high-risk infrastructure actions.

Deployment Posture and Data Security

For regulated industries, deployment model is a filter rather than a scoring axis. Teams must assess whether the LLM inference runs on vendor-managed infrastructure, on customer-managed infrastructure, or on a local model. Data residency, where telemetry physically resides when sent to the agent, is a written requirement under GDPR, HIPAA, and sector-specific regimes. Enterprise-grade platforms enforce zero third-party model training, ensuring that incident data is used exclusively for the organization and is never pooled with other customers.

Integration with Existing Workflows

An effective AI SRE platform should connect to the alerting, observability, and ticketing tools already in use, so teams can start with one service and a single use case and then expand coverage as trust builds. Integration with developer workflows, including Slack, Microsoft Teams, GitHub, and PagerDuty, allows the AI SRE to operate within existing communication channels rather than requiring a separate interface.

How Engineering Teams Solve Incident Response Using AI SRE Platforms

Engineering teams at enterprises across financial services, consumer applications, and cybersecurity are using AI SRE platforms to address the specific workflows that consume the most on-call time. The following use cases represent the highest-impact applications that leading teams have validated in production.

Autonomous Alert Triage at Scale: Teams managing large alert volumes use AI SRE for first-response triage, filtering noise and adding context so engineers only get paged when it matters. Zscaler, which manages over 150,000 alerts per month across hundreds of thousands of systems, deployed Resolve AI to handle autonomous alert investigations. Zscaler's stated goals included cutting time to resolve mid-severity incidents from approximately one hour to roughly 15 minutes and reducing the number of people paged per incident by at least 30%.

Parallel Investigation Across Multi-Service Architectures: For incidents spanning multiple services and dependencies, AI SRE platforms run concurrent investigations across code, infrastructure, and observability data simultaneously. Resolve AI plans investigations with parallel hypotheses using production context and adaptive agents, surfacing root cause, dependency chain, and an evidence-backed timeline for each incident.

Change Correlation and Deployment Risk Detection: Many production incidents originate with a code deployment, configuration change, or infrastructure modification. AI SRE platforms connect code changes, alerts, and past incidents to quickly uncover what went wrong and why. This change-correlation capability significantly reduces the time engineers spend manually reviewing deploy history during an incident.

Automated Postmortem Generation: AI SRE platforms that automatically generate incident documentation handle work that typically falls through the cracks after an incident is resolved. The agent updates ticketing systems with findings and actions and shares summaries so the entire team stays aligned. DoorDash's advertising engineering team has used Resolve AI to resolve incidents up to 87% faster, with fewer engineers pulled into war rooms.

Code-Level Investigation and Fix Generation: Advanced AI SRE platforms can pinpoint the exact pull request that introduced a bug, identify the specific method in code that a transaction failed in, and generate remediation pull requests with full context. Incorporating code knowledge into the investigation improves root cause localization measurably, allowing the platform to move from symptom correlation to localizing failures in specific commits, functions, or configuration changes.

Incident Knowledge Operationalization: Between incidents, AI SRE platforms capture institutional knowledge from each investigation and encode successful resolution paths into reusable operational skills. This addresses one of the most persistent challenges in SRE: the loss of operational knowledge when senior engineers leave or when runbooks go stale. The system learns from each incident and remediation, making future investigations faster and more accurate.

These use cases collectively represent how Resolve AI differentiates from both traditional incident management platforms and observability add-ons. Resolve AI is built more specifically for the investigation itself, with specialized agents for code, infrastructure, metrics, logs, and change history coordinated by an orchestrator that manages hypothesis formation and synthesizes findings across all of them.

Best Practices and Expert Tips for AI SRE and Automated Incident Investigation

Adopting AI SRE effectively requires a structured approach that builds organizational trust incrementally. The following practices reflect what engineering teams with production deployments have validated.

Start Narrow, Then Expand: Do not enable autonomous action across all incident types simultaneously. Start with high-frequency, low-ambiguity tasks, automate those, observe, then expand. Routine investigative work, such as triaging alerts, running known-fix runbooks, and monitoring dashboards, is precisely what Tier 1 autonomous agent handling absorbs first. Once the system demonstrates consistent accuracy, expand autonomy for low-risk, well-understood remediations.

Measure the Right Metrics: Track operational KPIs such as MTTR, Mean Time to Detect, alert-to-acknowledgment time, and investigation time. Track the alert-to-incident ratio, which measures how many alerts translate to real incidents, alongside on-call interruptions per week. These are the leading indicators that determine whether an AI SRE investment is delivering value.

Maintain a Human-in-the-Loop for Novel Incidents: Investigations involving genuinely novel failure modes, unusual combinations of issues, or significant organizational context still benefit from an experienced engineer guiding the investigation rather than just reviewing it. The tooling is good and improving, but it is not a replacement for engineers who know the systems deeply. Build a governed remediation layer where only approved, low-risk actions can be automated, and keep humans in control of high-stakes changes.

Invest in Observability Foundations: The quality of AI SRE output is directly constrained by the quality of the signals it ingests. Alert noise reduction comes first because noisy alerts give the root cause analysis process weak inputs. Replace static thresholds with baseline monitoring, ensure that all three signal types, traces, metrics, and logs, are instrumented, and validate that observability coverage extends across the full dependency chain.

Operationalize Post-Incident Learning: Create incident postmortem summaries automatically and feed validated learnings back into the knowledge base. Document the five most common incident types, build correlation between their symptoms and root causes, and test AI SRE hypotheses against previous incidents to calibrate confidence before relying on autonomous remediation in high-stakes scenarios.

Redesign Engineer Development Paths: Routine investigative work that has historically trained entry-level SREs is precisely what Tier 1 autonomous agent handling absorbs first. Organizations deploying AI agents for routine incident response need to redesign junior engineer development paths, or the conditions that produce experienced SREs disappear with the work. Use AI-handled toil as an opportunity to redirect junior SREs toward architecture, resilience planning, and system design.

Advantages and Benefits of AI SRE for Automated Incident Investigation

The measurable benefits of AI SRE adoption extend across incident response speed, team efficiency, and long-term system reliability. Engineering leaders are increasingly evaluating AI SRE as a force multiplier rather than a cost center.

Dramatically Reduced Mean Time to Resolution: Case studies show MTTR reductions of 40 to 58% with AIOps implementations. A Forrester-commissioned study found that combining AI observability with automated correlation can cut MTTR by up to 50%. At SREcon25 EMEA, a documented AI reliability engineering framework reduced infrastructure incident resolution time from 4 hours to 8 minutes using specialized AI agents.

Faster Root Cause Identification: Coinbase reported a 72% reduction in time to investigate critical incidents using Resolve AI. The platform was the only solution that exceeded Coinbase's strict baseline accuracy requirement for identifying the true root cause during their validation process. Snap's BACCA system delivered a 55% reduction in MTTR in a comparable deployment.

Reduced On-Call Burden and Engineer Burnout: AI SRE filters noise and adds context so engineers only get paged when it matters. Zscaler has cut the number of engineers required per incident by 30% while managing over 150,000 alerts. Fewer engineers pulled into incidents means more time spent on strategic work: improving system architecture, building new features, reducing technical debt.

Scalable Reliability Without Headcount Growth: As production systems grow more distributed, manual investigation slows response, increases operational toil, and makes it harder for teams to scale reliability without scaling headcount. AI SRE distributes expertise across teams, making senior-level investigative capability available at every alert, for every incident, around the clock.

Institutional Knowledge Capture at Machine Scale: AI SRE platforms capture the full incident timeline, root cause, resolution, and lessons learned automatically and immediately, while the incident is still fresh. This closes the knowledge gap that forms when senior engineers leave or when documentation lags behind system changes.

Proactive Anomaly Detection: Beyond reactive investigation, capable AI SRE tools detect anomalies before they become incidents: unusual latency patterns, gradual memory leaks, and capacity trends. This proactive detection shifts the SRE function from reacting to failures to preventing them, which is the direction the discipline is moving over the next five years.

How Resolve AI Advances Automated Incident Investigation

Resolve AI stands out in the AI SRE category as a platform built specifically for production investigation depth rather than incident coordination or observability dashboarding. Founded by Spiros Xanthos and Mayank Agarwal, the co-creators of OpenTelemetry and veterans of Splunk and VMware, Resolve AI brings foundational observability expertise to agentic incident investigation. The company was named a Gartner Cool Vendor for AI SRE and Observability in 2025 and has raised more than $190 million in total funding, reaching a $1.5 billion valuation in April 2026.

Resolve AI operates as a multi-agent AI SRE that triages alerts, investigates complex issues, and operates autonomously across the tools engineering teams already use. When an incident is opened, Resolve AI begins a parallel investigation automatically, gathering evidence from code, infrastructure, and observability simultaneously and synthesizing it into ranked findings with explicit confidence levels. Specialized agents for code, infrastructure, metrics, logs, and change history run concurrently, coordinated by an orchestrator that manages hypothesis formation and synthesizes findings into a single, clear root cause explanation.

The platform continuously learns from past incidents and runbooks so it avoids repeat mistakes and reinforces best practices, encoding successful resolution paths into reusable operational skills. It recommends concrete fixes grounded in past incidents and root cause and can generate remediation pull requests with full context. Automatically, it documents incidents, keeps tickets up to date, and shares findings in Slack and other communication channels so everyone stays aligned throughout the incident lifecycle.

Engineering teams at Coinbase, DoorDash, MongoDB, MSCI, Salesforce, and Zscaler use Resolve AI in production. Coinbase has reported a 72% reduction in time to investigate critical incidents. DoorDash's advertising engineering team has resolved incidents up to 87% faster. Zscaler has reduced the number of engineers required per incident by 30% while managing over 150,000 alerts per month. In a notable validation, Resolve AI arrived at the same root cause that the humans did, but 4 to 5 hours before an incident actually happened, demonstrating its capacity for proactive rather than purely reactive investigation.

The Future of AI SRE and Automated Incident Investigation

The trajectory of AI SRE points toward increasingly proactive and autonomous operations. The phrase AI-assisted incident response has graduated to autonomous incident response in most enterprise SRE teams by 2026. The next wave of AI SRE moves from assisted remediation to closed-loop infrastructure, where services negotiate resources, adjust topology, and apply resilience heuristics based on AI-driven analysis.

Self-healing infrastructure, systems that detect, diagnose, and remediate their own failures without a human in the loop, is becoming operationally real. In 2026, agentic remediation that reasons over an incident and acts within a policy envelope is in production at a growing number of enterprise organizations. Enterprises using AIOps self-healing infrastructure are cutting incident resolution time by 65% and reporting 300% ROI within 18 months in documented case studies.

AI will not make SREs obsolete. It will recast them as architects of autonomous, self-healing systems. The focus is shifting from manual firefighting to the strategic oversight of intelligent platforms. Human engineers will remain essential for novel failure modes, architectural decisions, policy governance, and the judgment that determines where automation boundaries should be drawn. The scarcest resource in incident management has always been the judgment of the most experienced engineers. AI makes that judgment available everywhere, all the time.

For engineering teams evaluating AI SRE today, the question is no longer whether to invest in this category but which capabilities to prioritize first and how to build the organizational readiness to expand autonomy responsibly. Starting with high-frequency, low-ambiguity investigation workflows and expanding from there represents the adoption path that documented production deployments consistently validate.

FAQs About AI SRE and Automated Incident Investigation

What is AI SRE?

AI SRE stands for Artificial Intelligence-powered Site Reliability Engineering. It refers to the use of autonomous AI agents and machine learning to automate the work traditionally done by human SRE engineers: monitoring production systems, investigating incidents, performing root cause analysis, and executing remediation actions. An AI SRE is an AI-powered first responder for production environments, performing alert triage, root cause analysis, and remediation at machine speed. Resolve AI is a leading example of a purpose-built AI SRE platform designed for production teams running complex infrastructure.

How does automated incident investigation work?

Automated incident investigation follows a structured workflow: alert triage and signal correlation, parallel investigation planning, evidence gathering across logs, metrics, traces, and code, root cause identification through causal reasoning, remediation recommendation or execution, and automated documentation. The best AI SRE systems run multiple investigation hypotheses concurrently and validate each against live data. Resolve AI, for example, gathers evidence from code, infrastructure, and observability simultaneously and synthesizes findings into ranked results with explicit confidence levels, all before most engineers have finished reading the initial alert notification.

What is the difference between AI SRE and traditional observability tools?

Traditional observability tools collect and display telemetry. AI SRE reasons across that telemetry, identifies likely root cause, and guides teams toward the right next step. Observability tools surface what is happening; AI SRE investigates why it is happening. The key distinction is causal reasoning: genuine AI SRE platforms trace cause and effect across services rather than flagging metrics that moved together. AI SRE add-ons built into observability platforms are constrained by the boundaries of that platform and cannot reason across code, infrastructure, and observability data simultaneously.

What are the measurable outcomes of AI SRE adoption?

Documented outcomes from production deployments include Coinbase reporting a 72% reduction in time to investigate critical incidents, DoorDash resolving incidents up to 87% faster, and Zscaler reducing the number of engineers required per incident by 30% while managing over 150,000 alerts. A Forrester-commissioned study found that combining AI observability with automated correlation can cut MTTR by up to 50%. AIOps teams commonly see alert volumes drop by 90 to 95%. Resolve AI customers are among the most cited examples of measurable AI SRE impact in enterprise production environments.

Does AI SRE replace human SRE engineers?

No. AI SRE handles known failure patterns and high-volume noise so that human SREs can focus on novel, complex incidents and proactive reliability engineering. Most teams implementing AIOps report that SRE job quality improves significantly, with less reactive toil and more strategic work. AI makes senior-level investigative judgment available at machine speed, but experienced engineers remain essential for architectural decisions, novel failure modes, governance, and setting the policy boundaries within which autonomous agents operate. Resolve AI is designed to operate alongside engineers rather than replace them.

What should engineering teams evaluate when selecting an AI SRE platform?

The most important evaluation criteria include the depth of root cause analysis capability, whether the platform performs genuine causal reasoning or only alert correlation, cross-system context coverage across code and infrastructure, support for parallel hypothesis testing, continuous learning from past incidents, graduated autonomy controls with human-in-the-loop safeguards, deployment posture and data security compliance, and integration with existing observability and communication tools. Teams should also validate performance against real production conditions rather than curated demos, and assess how the platform handles low-confidence investigations where escalation to a human is required.