Having perfect intelligence is worthless if it doesn't produce a decision. The history of security operations is full of tools that generated insights no one acted on — because the insights came too slowly, in the wrong format, or without clear recommended actions.
D2R's Decision layer is where intelligence becomes action. It takes the correlated, confidence-scored event sets from the KnowledgeGraph and produces one of three outputs: automated response (for high-confidence, pre-authorised scenarios), analyst escalation with full context pre-assembled, or watchlist monitoring for developing patterns.
Playbooks: The Decision Framework
Every action the Decision layer can take is governed by a playbook — a pre-defined, client-approved decision tree that maps event patterns to responses. Playbooks are built during the D2R deployment phase in collaboration with the client's security and operations teams. They encode institutional knowledge that would otherwise live only in the heads of experienced analysts.
A playbook might specify: if a badge access anomaly is correlated with an OT network anomaly, and confidence is above 0.9, automatically lock the affected badge, isolate the OT subnet, and page the on-call security architect — simultaneously, in under 3 seconds.
Reducing False-Positive Fatigue
The number one reason security teams stop responding to alerts is false-positive fatigue. When 97% of alerts turn out to be noise, analysts learn to treat all alerts as noise. This is rational behaviour in a broken system.
D2R's confidence scoring and playbook framework attack this at the source. By the time an alert reaches an analyst in the D2R Decision layer, it has already been correlated across multiple independent signals and scored. Analysts in D2R deployments report that fewer than 8% of escalated events turn out to be false positives — compared to 40-60% in traditional SIEM deployments.
Human-in-the-Loop Design
Not every decision should be automated. D2R's Decision layer is explicitly designed to support human-in-the-loop operation for high-stakes scenarios. For events involving OT shutdown, physical lockdown of occupied areas, or classified network isolation, the Decision layer assembles the full context, presents recommended actions ranked by confidence, and requires a single confirmed action from an authorised operator.
The time saved is not on the decision itself — it's on assembling the information needed to make a good decision. That pre-assembly step, which previously took 15-30 minutes, happens in under 10 seconds.
Compliance-Mapped Decisions
For regulated environments, every Decision-layer action is automatically tagged to the relevant compliance framework — NERC CIP control identifiers, CMMC practices, HIPAA administrative safeguards — and logged with full audit trail. This eliminates the separate compliance evidence-collection workflow that typically runs parallel to security operations.