Your SOC's AI Can Act on Its Own. But Can It Tell You Why?

Introducing CARTS, the open framework for making AI decisions in the SOC transparent and auditable

By Martin Holste and Shristi Sharma · November 2, 2026

Agentic AI has arrived at the SOC. The newest security tools don't just summarize alerts; they plan and take action—isolating a host, disabling an account, blocking an address—at machine speed. That's exactly the help an understaffed, alert-saturated security team needs.

They’re also the tools most CISOs aren't ready to turn on.

The reason is simple: the "black box" problem. An agent recommends isolating a critical server, and the first question from the person accountable for that decision is, "Based on what?" If the only answer is a confidence label the agent vendor won't explain, automated remediation stays off, no matter how good the model is. Trust isn't a feature you ship. It's something the system has to earn, every time, in a way a human can inspect.

That's the gap the Confidence, Auditability, Reversibility, Trust, and Safety (CARTS) Framework is built to close. And confidence is only part of the answer. Just as important is reversibility—knowing, before an agent acts, whether the action can be undone. A high-confidence call you can't take back carries very different risks from one you can, so CARTS treats that distinction as a first-class input to what the AI is allowed to do on its own.

From "How many alerts did we close?" to "How confident was the decision?"

For a decade, SOC success has been measured by volume: alerts triaged, cases closed, mean time to respond. Those numbers reward activity instead of judgment, and they tell you nothing about whether the AI now making calls on your behalf is making good ones.

CARTS proposes a different scoreboard. As autonomous action becomes normal, the metric that matters is the confidence behind each decision, and whether that confidence can be traced, questioned, and reversed. It reframes the SOC around confidence-based risk management instead of volume-based busywork.

Crucially, CARTS is designed as an open, vendor-agnostic framework, aligned with the principles of the Open Secure AI Alliance (OSAIA). The point isn't to measure confidence in one company's product. It's to give the whole security ecosystem a shared, auditable way to measure it, so a confidence score means the same thing no matter which vendor's telemetry produced it.

Five pillars every trustworthy agent should satisfy

To turn trust into a practical standard, CARTS establishes five core requirements for any AI agent in a production environment:

• Confidence: A quantifiable 0%–100% score built from verifiable data points across situational, business, and historical context.
• Auditability: A human analyst can review the agent's line-by-line reasoning and trace every conclusion back to its source telemetry.
• Reversibility: The agent declares whether an action can be undone before it acts, enabling safe "undo" workflows.
• Trust: Automation fires only once a predefined, audited confidence threshold is met.
• Safety: The agent actively questions environmental data to verify asset identity, and refuses to act on missing or conflicting information.

Together they turn "trust the AI" into a set of conditions you can define, inspect, and enforce.

How a confidence score actually gets built

The heart of CARTS is that the confidence number is not a black-box output. It's a sum of weighted factors, each fed by different parts of your stack:

Those weights are recommended defaults, not fixed constants. Every organization can tune them to its own risk tolerance and telemetry maturity. What CARTS standardizes is the schema: five factors that sum to 100%, scored the same way everywhere.

Two additional rules, confidence decay and conflict penalty, keep this score grounded. Confidence decay ages out stale verdicts so old conclusions can't inflate today's score. And a conflict penalty means that when two sources disagree about the same asset, the score is penalized rather than quietly averaged until multisource verification resolves the conflict. In other words, the framework is engineered to be skeptical on your behalf.

Earning automation, one step at a time

CARTS doesn't ask you to flip a switch and hope. It lays out a four-step path that respects a CISO's need for control:

• Access: Connect the AI to your ecosystem telemetry (e.g., network, identity, EDR).
• Define: Configure expectations: SOPs, VIP lists, authorized tools.
• Audit: Run in "show-your-work" mode, where analysts review the reasoning line by line and build trust.
• Automate: Enable auto-remediation only once the CARTS score consistently clears your risk threshold.

You don't automate because a vendor promised accuracy. You automate because you watched the reasoning, saw the score hold, and decided it earned the keys.

Safe by design: Reversibility before action

The safest automated action is one you can take back. CARTS requires an agent to declare reversibility before it executes and to set the bar accordingly:

• Reversible actions (e.g., isolate host, disable user) can auto-execute at high confidence with a published undo path.
• Time-boxed actions (e.g., block an IP with a TTL) auto-execute and self-reverse on expiry.
• Irreversible actions (e.g., delete a cloud resource, wipe an endpoint) always require human approval, with blast radius spelled out.

Two more safeguards round it out: transparency of inaction—when confidence falls short, the agent logs exactly why it didn't act, so telemetry gaps become visible instead of silent; and multisource identity verification, which requires high-stakes actions to confirm asset identity across at least two independent sources before proceeding. And because an agent is only as good as the model behind it, CARTS treats model provenance as a first-class, auditable attribute: which model, which version, where it runs, and who controls it.

Why this is good for everyone

Here's the part that makes CARTS a standard rather than a feature. Because confidence is scored and traceable, you can finally see which telemetry sources actually move the needle on good decisions. For security teams, that's hard evidence for where your tooling budget is working. For technology partners, it's a standardized way to prove the ROI of their telemetry and APIs by turning data from a commodity into a measurable confidence input. CARTS measures contributions; it doesn't rank vendors to shame them. Everyone has a reason to participate.

Where Trellix fits

Trellix authored CARTS and is bringing it to the open community because an agentic SOC built on trust needs a trust standard the whole industry can adopt—not another proprietary black box. You can see these principles already at work in Trellix Wise, our agentic AI built to show its reasoning, respect your thresholds, and act only when the confidence is there. The framework describes the bar; Trellix Wise is one implementation clearing it.

The shift is coming either way: security operations will be judged less by the volume of alerts they triage and more by the confidence of the AI making their decisions. CARTS is how you make that confidence something you can measure, audit, and trust.

Learn more about CARTS: Read the complete methodology behind the framework. Download the CARTS white paper: How to Have Confidence in AI Decision-making.

See CARTS in action: Learn more about how Trellix Wise brings confident, auditable AI to the SOC at Trellix.com/platform/wise.