Why MARS

The model is one step in a pipeline MARS controls.

Checks sit on both sides of it.

It can decline to answer

When evidence is thin, the case stays undecided and goes to a person.

If the AI cites something MARS never collected, the conclusion does not stand.

A case still in progress shows its progress and nothing else.

MARS proposes remediation, never runs it alone, and verifies the outcome afterwards.

Mail bodies, file names and links reach the model as material to examine, never as instructions.

A hosted model, a company gateway or a local model. The host decides which endpoints are allowed.

Each approach has something it is good at. The rows below are where they differ.

	By hand	Straight to an AI model	MARS
First read of each case	An analyst, one case at a time.	The model.	MARS gathers the evidence, then asks the model.
What the model is given	No model is involved.	Whatever is pasted in, as written.	The evidence MARS collected, marked as evidence.
Text in an email aimed at the AI	Does not apply.	Reads as part of the request.	Stays data, inside a marked boundary.
An answer with nothing behind it	Depends on the analyst.	Looks the same as a sound one.	Rejected, or held for review with a reason.
When the evidence is thin	The analyst escalates.	Nothing stops it answering.	The case stays undecided and goes to a person.
Response actions	The analyst carries them out.	Whatever is built around the model decides.	Proposed by MARS, approved by a person, checked afterwards.
Where case data goes	It stays in the tools you already use.	To the model's provider.	It stays on your host. You choose the model endpoint, a local one included.
Record of each decision	Tickets and notes, where they are kept.	A chat history.	A signed audit log, with the evidence behind each verdict.
Changing the model or its instructions	Does not apply.	Nothing checks what changed.	A change to the instructions is detected and needs sign-off. Known cases can be replayed to compare quality first.
What it takes to run	Analyst hours that grow with volume.	Very little.	A host to operate and Microsoft connections to configure.

The middle column describes sending case content to a general-purpose model with nothing around it. It does not describe any particular product.

The model reads and reasons. MARS decides what it sees and what becomes of its answer.

The model answers within defined fields and options. Anything else is discarded.

Mail, XDR incidents, sandbox results and the analyst assistant can each use a different one.

Every call is counted against a daily budget before it is sent.

A change to the instructions is detected automatically and has to be approved as a release. Known cases can be replayed to compare quality first.

Answers are produced in English and translated into Traditional Chinese in the background.

Who did what, and when, is written to a signed log.