How Trellix Cut AI Investigation Cost 30x by Routing Work Across Models

Cybersecurity firm Trellix rebuilt the engine behind Trellix Wise, its generative-AI threat-investigation system, around a deliberate multi-model architecture — and lowered inference cost by a factor of 30 while sustaining the accuracy its security analysts demand, according to AWS engineering documentation and Anthropic's customer record.

The situation before

Trellix emerged in 2022 from the merger of McAfee Enterprise and FireEye, and today serves more than 53,000 customers with an AI-powered security platform. Its analysts live inside a firehose. As the company describes in its Harvard Business Review sponsor feature, most enterprises that leave their detection tuning untouched face over a thousand security alerts per day. Every one of those alerts represents a decision: escalate, dismiss, or investigate. Human triage at that volume produces fatigue, and fatigue produces missed intrusions — attackers move fast enough to exfiltrate data before an analyst reaches the alert that mattered.

Trellix Wise answered that volume with autonomous investigation: the system analyzes and triages events across endpoint, network, email, and cloud, correlates threat intelligence with historical data, and assigns a risk score to each event. The obvious way to build it was the default of the moment — send every stage of every investigation to a single frontier model. That design worked on accuracy and collapsed on economics. The cost scaled linearly with alert volume, and alert volume was the whole problem.

The decision that made it possible

Trellix made a design call that reads as counterintuitive: refuse the one-big-model default and route each stage of an investigation to the model that fits its complexity. The team recognized that a threat investigation is a chain of distinct tasks, and that each task carries its own accuracy requirement. Deep reasoning and final risk scoring stayed with Anthropic's Claude Sonnet, the model that reaches the highest level of analytical detail. The high-frequency, moderately complex stages — data collection and retrieval — moved to Amazon Nova Micro, a lightweight model that runs on the same Amazon Bedrock platform.

The elegant part is the multi-pass move. Rather than one expensive Sonnet call for the data-collection stage, Trellix runs several Nova Micro passes in parallel, maximizing coverage of the data an investigation needs. Because Nova Micro costs almost 100 times less per inference and runs 3 to 5 inferences in the time of a single Sonnet call, the team buys broader coverage and faster turnaround at a fraction of the price. To keep the small model reliable, Trellix constrains its outputs with proprietary prompt engineering and reference data, holding hallucinations inside acceptable bounds for the target task. A third model, Amazon Nova Lite, handles lightweight coding and connector integration in professional services.

The result — with full context

The architecture-level payoff is the factor-of-30 reduction in investigation cost that the multi-pass design delivers, built from the roughly 100x lower per-inference cost of Nova Micro applied to the stages that dominate volume. Speed rose in step: Nova Micro produces 3 to 5 inferences in the window a single Sonnet inference would occupy, and Trellix reports a 30-second initial alert analysis inside the system.

The downstream effect on analysts is the number that matters to a security operations center. Anthropic's customer record documents 8 hours saved for every 100 security alerts the system processes — throughput equivalent to adding 10 security analysts to the team. The HBR feature adds the detection outcome: Trellix Wise reduced the average customer's live alert count from over a thousand to fewer than ten, and cut mean time to detection by up to 50 percent. Connector build time that once ran 40 hours now completes in under five minutes.

SAGA holds honesty as the standard, so the caveats travel with the metrics. AWS describes the deployment as a phased roll-out into production following pilot evaluation — this is a system in active expansion. The engineering team also flags that Nova Micro shows higher output variability than larger models, which is exactly why they wrap it in prompt constraints and reserve final judgment for Claude Sonnet. And they note plainly that standardized public benchmarks proved insufficient for the decision: Trellix evaluated each model against its own use case, task by task, to learn where the small model held accuracy and where the large model earned its cost. The routing map is the product of that measurement, not a rule of thumb.

What other organizations can learn

The transferable lesson lands hardest for any team watching its LLM bill climb faster than its usage justifies. Trellix treated an exploding inference cost as an architecture problem rather than a budget problem — and architecture is replicable in a way that budget headroom is rarely. The playbook has three moves. First, decompose the workflow into stages and name the accuracy each stage truly requires, because a data-retrieval pass and a final risk verdict deserve different models. Second, route the high-frequency, lower-stakes stages to a small fast model and reserve the frontier model for the judgment calls, using multi-pass validation to recover coverage the small model would surface alone. Third, measure on your own workload — the routing map that saved Trellix 30x came from task-specific evaluation, and yours will differ.

The condition for replication is discipline about where accuracy is load-bearing. Teams that route blindly to cut cost will trade away the outcomes that justified the AI in the first place. Trellix earned its savings precisely because it kept Claude Sonnet on the stages that decide whether a real intrusion gets caught, and moved everything else to models that are highly accurate for their narrower task. The result is a cost structure that scales with the mission instead of fighting it.