AI decision models offer low-cost SOC triage, but live scans found 51% of infected endpoints had already been marked mitigated by EDR.