When to Use an LLM as a First-Pass Reviewer

Sort alerts along two axes: consequence and ambiguity.

Consequence is what happens if the alert is wrongly closed. A duplicate login notice from a known device is low consequence. A sanctions match, a structuring pattern near a reporting threshold, or a large cross-border transfer from a newly onboarded account is high consequence. DataRobot's workflow scores each alert and sends cases above a threshold to investigators while lighter review handles the rest, per DataRobot.

Ambiguity is how much judgment the right disposition needs. "Password reset from a new region" often resolves with two facts: did the reset succeed, and did the login come from last week's device fingerprint. A crypto deposit that looks like layering across six hops needs an investigator with the network graph.

The top-left cell is where savings live. The top-right cell turns a five-minute investigation into a 30-second confirmation. The bottom-left cell is subtle: a sanctions match can be factually simple, but the consequence is severe enough that the model should collect disambiguating evidence (customer profile, prior cleared matches, fuzzy-match score) and hand it up rather than close it. The bottom-right cell is the human queue.

A useful rule of thumb: if you would let a new analyst with three weeks of training close the alert unsupervised, an LLM can probably pre-screen it, provided its measured agreement with experienced reviewers clears your bar. If not, the model does not close it either.

Fraudio's transaction monitoring guide states the constraint plainly: a monitoring system is not there to make decisions on behalf of an analyst, that is not legal under most frameworks, and its job is to reduce noise, surface what matters, and accelerate the investigation, per Fraudio. Regulators expect a risk-based approach and a full audit trail on every click.

That gives a clean design constraint: the LLM recommends, the recommendation is logged with the evidence used, and the human decision stays the decision of record. Fraudio describes four layers of a working program, namely detection rules, behavioral analysis, case management tied to regulatory SLAs, and an immutable audit trail, which is a good checklist for the record-keeping around any model step.

Sumsub's guide draws a related line between monitoring and screening: screening checks parties against sanctions or watchlists before or during processing, while monitoring analyzes behavior over time, per Sumsub. An LLM first pass belongs on the monitoring side, where context and narrative matter, not on the screening side, where a fuzzy-match score and a list lookup usually do the job cheaply.

The SOC research carries a transferable lesson. The framework in the arXiv paper requires an explicit proposed decision before an independent challenge, keeps the challenge in a separate reasoning context, and records everything in an append-only investigation ledger, per the arXiv paper. The paper also found that same-context review has negative net correction, meaning a model reviewing its own decision in the same thread does not reliably catch its own errors. If you ask the model to check itself, use a separate prompt, a separate context, and explicit evidence requirements.

Deloitte's contact center research explains why the human layer cannot be a formality. In a survey of 100 banking customers and 30 banking executives, 28 percent of customers with repeated negative service experiences reduced spending with the bank, and 31 percent stopped doing business with it entirely, per Deloitte. Automation that closes faster but escalates clumsily can be worse than the slow queue.

A model cannot apply a criterion you cannot write down. Before measuring anything, write a rubric with three to six criteria per alert category, each with an observable test. Censinet's evaluation guide describes rubric-based evaluation as a structured scoring guide defining what good, acceptable, and poor output looks like, and warns that vague guidance lets two analysts score the same output very differently, per Censinet.

A rubric fragment for a password-reset-from-new-region alert:

1. Identify the account owner and whether the reset completed.
2. Check whether the device or IP appeared in the prior 90 days.
3. Check whether a successful login followed the reset.
4. Check whether any high-value transaction happened within 24 hours of that login.
5. State a disposition and cite the fields used.

Ask the model to return a structured object with a disposition, a confidence, and an evidence list. If any required evidence is missing, the prescribed output is "insufficient evidence, escalate," never a guess. The arXiv paper found attack alerts are more likely to be dismissed when searches return no records, exactly the failure mode an explicit insufficiency rule targets, per the arXiv paper.

Version the rubric alongside the prompt. LaunchDarkly's LLM evaluation guide argues for treating prompts, models, and parameters as versioned configuration so a failing score can roll back production behavior at runtime, per LaunchDarkly. In a compliance pipeline, the rubric text, prompt, model identifier, and output schema all carry versions, and the version goes into every alert's audit record.

Build a labeled sample of a few hundred examples per category. The arXiv benchmark used 1,247 alerts for one multi-stage attack scenario, per the arXiv paper. Have two experienced reviewers label independently, reconcile disagreements, and record the reconciled label as ground truth. If they cannot agree on a clear-cut case, the rubric is not tight enough and the category stays with humans.

Compute four numbers per category: precision of closure (of alerts the model closed, the share truly benign), recall of escalation (of suspicious alerts, the share escalated), false-negative rate, and coverage (the share of alerts the model was willing to decide at all). Precision protects the audit record. Recall protects you from the consequence you feared. Coverage tells you whether the economics work.

The threshold choice is a business decision framed by cost asymmetry. DataRobot's figures, $30 to $70 per review against $145 million average penalties for proven money laundering, show the direction clearly even though the penalty number is an average across proven cases, per DataRobot.

A worked example. A category generates 10,000 alerts a quarter, 2 percent genuinely suspicious. A model that closes 8,000 at 98 percent precision wrongly closes 160, which at that base rate is 160 of roughly 200 truly suspicious alerts. That is a recall disaster wearing a good precision number. The same model closing 3,000 at 99.5 percent precision wrongly closes 15 and pushes 7,000 to humans. Report precision, recall, and raw counts together, always.

To compare candidate models on the same sample without separate provider SDKs, one OpenAI-compatible endpoint such as Quanta Inference keeps the evaluation harness constant across text models.

from collections import defaultdict

def score(labeled_alerts):
    # each alert: category, human_label ("benign"/"suspicious"),
    # model_decision ("close"/"escalate"/"insufficient")
    buckets = defaultdict(lambda: {"tp": 0, "fp": 0, "fn": 0, "tn": 0, "deferred": 0})
    for a in labeled_alerts:
        b = buckets[a["category"]]
        if a["model_decision"] == "insufficient":
            b["deferred"] += 1
            continue
        closed = a["model_decision"] == "close"
        suspicious = a["human_label"] == "suspicious"
        if closed and suspicious:
            b["fn"] += 1
        elif closed:
            b["tn"] += 1
        elif suspicious:
            b["tp"] += 1
        else:
            b["fp"] += 1
    out = {}
    for cat, b in buckets.items():
        decided = b["tp"] + b["fp"] + b["fn"] + b["tn"]
        closed_total = b["tn"] + b["fn"]
        out[cat] = {
            "closure_precision": round(b["tn"] / closed_total, 4) if closed_total else None,
            "escalation_recall": round(b["tp"] / (b["tp"] + b["fn"]), 4) if (b["tp"] + b["fn"]) else None,
            "coverage": round(decided / (decided + b["deferred"]), 4) if (decided + b["deferred"]) else None,
            "raw": dict(b),
        }
    return out

Read the raw counts per category. A 97 percent overall precision can hide one category at 70 percent.

The human queue is a designed surface with its own rules, not the leftovers. Route to humans, always: every high-consequence alert regardless of model confidence; every insufficient-evidence alert; every alert type absent from the labeled sample or whose pattern frequency has moved outside the training distribution; every disputed alert; and a random sample of model-closed alerts sized so a chosen precision drop is detected within a defined window.

That sample is the audit and the feedback loop. Human dispositions on it become the next round of labeled data.

Censinet is blunt about continuous monitoring: one-time validation is insufficient because models drift, environments change, and attack patterns evolve, per Censinet. Set a monthly sampled audit, a quarterly full re-measurement on a fresh sample, and trigger-based re-measurement whenever the model, prompt, or rubric changes, a new alert rule ships, or the escalation rate leaves its expected band.

The University of Turku thesis on LLM agents for SOC tier-1 triage concluded that a hybrid approach using agents as co-pilots is essential to capture benefits and limit risk, citing occasional hallucinations, integration complexity, and privacy concerns, per the thesis. Design the interface accordingly: reviewers see the model's disposition, evidence list, and stated confidence first, then the raw data. A reviewer who reads the raw data first anchors on their own view and rubber-stamps the model.

Asapp's catalog separates fraud alert verification from fraud detection and escalation, per Asapp. Copy that separation: the model verifies whether an alert matches a known benign pattern, while escalation stays with a person.

Track four live metrics per category: closure rate, escalation rate, insufficient-evidence rate, and the human override rate on sampled model-closed items. A rising insufficient-evidence rate usually signals upstream data quality changes. A rising override rate signals drift. A sudden jump in closure rate is a red flag, not a win.

For the audit trail, log the rubric version, prompt version, model identifier, evidence items cited, disposition and confidence, and the human decision with a reason code. Fraudio lists the immutable audit trail as one of four layers of a working program and notes regulators expect full trails on every click, per Fraudio. A model step invisible in the case file is a supervisory finding waiting to happen.

Budget the token cost of the evidence the model reads, not just the alert text. A pass that pulls a customer profile, 90 days of device history, and three prior case notes costs several times more than one that reads only the alert. Measure cost per decided alert against the $30 to $70 human review cost in DataRobot's figures. If the model costs more than the review it replaces and coverage is low, it saves nothing.

Model selection is empirical and changes as models change: run the same labeled sample against each candidate and decide on the numbers. If your team would rather spend time on dispositions than plumbing, Quanta Experts can run a triage program and hand back finished deliverables, while rubric and queue ownership stays in-house.