We let a fruit fly brain triage 12,716 real SOC Alerts. Here is what happened.

On September 3, 2026, HHMI Janelia, the University of Cambridge and Google Research published the complete wiring diagram of a male fruit fly's central nervous system: 166,700 neurons and 125 million synapses, mapped one at a time from electron microscope slices, released for free.

Within a week the internet had wired it to Doom, Minecraft, Beat Saber, an options-trading bot, and a fake social feed it could doomscroll. That last one got 780,000 views.

We built an AI SOC. So we did the obvious thing. We made the fly triage alerts.

Try it yourself: Go to Fly Triage, pick a real (anonymized) alert, watch 165,000 neurons fire, and see whether the fly agrees with Intezer.

The question

Every one of those demos follows the same recipe. Load the connectome as a frozen network of leaky integrate-and-fire neurons. Push your input into some sensory neurons. Read spikes out of some other neurons. Train a small linear layer on the spikes. Declare that the fly plays Doom.

Two teams who bothered to run a control found something awkward: a scrambled connectome, same neurons, same number of synapses, random wiring, did exactly as well. The evolved wiring did not matter. The demos were reservoir computing with an expensive random reservoir.

So our question was not "can a fly brain triage alerts?" A big enough pile of random nonlinear units plus a trained readout can do a lot of things. Our question was: does the fly's actual wiring do anything an equally large random tangle would not? And, more usefully for people who run SOCs: how does a frozen 166,000-neuron brain compare with the boring linear model you could train in eleven seconds?

The short version

The setup

The alerts

12,716 alerts from Intezer's own environment, the tenant where our AI SOC protects our own company, over the last 180 days: an endpoint detection product, two SIEMs, an identity provider, a cloud security platform, Chrome security events, AWS CloudTrail, and every email an employee reported as phishing. For every alert we have the verdict Intezer's Autonomous SOC reached after investigating it.

We collapsed those verdicts to two classes. Escalated means Intezer flagged the alert for a human, either as an escalation or as follow-up required: 606 alerts, 4.8%. False positive means Intezer closed it as no action needed: 12,110 alerts. That imbalance is what a real SOC looks like. It also makes plain accuracy useless: a model that calls everything a false positive is 95% accurate and catches nothing. So we use two scores that do not care about the imbalance. ROC-AUC is the probability that a randomly chosen escalated alert gets a higher score than a randomly chosen false positive: 0.5 is a coin flip, 1.0 is perfect. Precision-recall AUC asks the question an analyst actually cares about: of the alerts the model flags, how many deserved it, averaged over every possible flagging threshold. It is far less forgiving when the thing you are looking for is rare.

The fly never sees the verdict. Before an alert reaches it we strip everything Intezer produced while investigating, every verdict anyone wrote back into the alert afterwards, and every identifier such as hostnames, usernames and emails. What remains is what the detection product originally said about the event. Without that step the fly would simply be reading the answer off the page, and the experiment would mean nothing.

The brain

MaleCNS v1.0, all 165,122 traced neurons. We keep connections with five or more synapses, the standard threshold in the published fly models, which leaves 6.2 million connections. Each connection's weight is 0.275 mV per synapse, positive if the presynaptic neuron's predicted neurotransmitter is acetylcholine, dopamine, octopamine or serotonin, negative for GABA, glutamate and histamine. Every neuron is a leaky integrate-and-fire unit with a 20 ms membrane time constant, resting at -52 mV, firing at -45 mV, refractory for 2 ms. This is the Shiu et al. 2024 model that the whole hobbyist ecosystem runs on.

One number, the gain, scales the strength of every synapse in the brain at once. Think of it as a volume knob. Too low and the alert's smell fades out after the first few neurons and the brain stays silent. Too high and every neuron excites every other one into a seizure. We turned the knob up from silent and stopped where an alert makes about 9,800 neurons fire about 112,000 spikes over 200 simulated milliseconds. That is a loud brain: about 59% of the Kenyon cells, the fly's odor-memory neurons, respond to a typical alert, where a real odor would recruit maybe 5 to 10% of them. We tried the quieter, more fly-like setting too (about 3,200 active neurons, 10% of Kenyon cells): the fly did worse, AUC 0.81, and it kept improving the louder we made it, up to a point. The gain sweep below shows the whole curve.

Turning an alert into a smell

Flies do not have a JSON input. They have about 50 olfactory glomeruli and 60-odd gustatory receptor types. An odor is a graded pattern across those channels, and every receptor neuron of a type fires together.

So an alert becomes a smell. We break it into tokens, structured fields first: alert.severity=high, sender=post.xero.com, ransomware, powershell, encodedcommand. Each token is hashed onto one of the fly's 121 chemosensory receptor types. A type that catches more tokens is driven harder, from 31 Hz to 125 Hz, and all of its receptor neurons fire together as a regular train. An alert typically lights up about 30 of the 121 channels.

That is a brutal bottleneck, on purpose. It is the fly's actual nose. One of our baselines asks what a linear model can do with exactly those 121 numbers and no brain at all.

What we read out

Spike counts of every non-input neuron that fires in at least 2% of alerts: 10,935 neurons. Log-transformed, standardized, into a logistic regression with balanced class weights. Five-fold cross-validation, same folds for every model. The regularization strength is chosen on the same grid for every model so nobody gets a tuning advantage.

The connectome is never trained. Nothing inside the fly changes. The readout is the only thing that learns.

The controls

1. Scrambled connectome. Every neuron keeps its exact in-degree, out-degree, and outgoing weights. We only shuffle who connects to whom. If the fly beats this, its evolved wiring carries information about alerts, which would be strange.‍

2. Random reservoir. Same number of connections, same weight distribution, uniformly random wiring. Not even the fly's degree statistics survive.

3. No brain, same nose. Logistic regression directly on the 121 channel drive levels.

4. No brain, no nose. Logistic regression on a 4,096-dimensional hashed bag of the same tokens. The model you would actually ship.

5. Shuffled labels. Same fly features, permuted verdicts. Should sit at AUC 0.5. It does: 0.483.

Results

The fly works. Given nothing but 121 smell channels, the frozen connectome turns an alert into a pattern of about 9,800 firing neurons from which a linear readout recovers Intezer's verdict at AUC 0.887. That is real signal (the shuffled-label control sits at 0.483), and it beats the same 121 numbers fed straight into logistic regression (0.874). The brain adds something over its own nose.

Then the controls arrive, in the wrong order.

Scrambling the connectome made it better. Same neurons, same in- and out-degrees, same synaptic weights, shuffled targets: AUC 0.910, precision-recall AUC 0.385 versus the real fly's 0.300. The two teams who ran this control on the Doom-style demos found the scrambled brain matched the real one. On alerts it wins.

A pure random reservoir made it better still. Throw away the fly entirely, keep only the connection count and weight distribution, wire uniformly at random: 0.918, with a precision-recall AUC (0.426) 40% higher than the real fly's.

And the boring model beat them all. Logistic regression on a hashed bag of the alert's tokens, the thing you would write in eleven seconds if nobody had mentioned flies: 0.922 and 0.476. It trains in under a minute on a laptop. The fly took a 20 MB connectome download, a GPU that turned out to be throttled to 210 MHz, a rewrite of the simulator in numba, and 11 million simulated neuron-seconds.

Where does the fly lose? Two places, and both are biology doing its job.

First, the nose. Squeezing an alert into 121 channels throws away most of it. The channel-only baseline (0.874) versus the token baseline (0.922) is the price of the bottleneck, and every brain model inherits it. The fly's advantage over its own nose (0.887 versus 0.874) is modest because the brain cannot invent information the antenna discarded.

Second, and this is the interesting one: the fly's wiring is built to make smells look alike. The antennal lobe normalizes across glomeruli, each Kenyon cell in the mushroom body listens to a handful of projection neurons under strong global inhibition, and the whole system is tuned for a stable, sparse odor code. That is exactly what you want for recognizing a rotting banana in a windy orchard. It is exactly what you do not want when the "smell" is an alert and the differences that matter are small. Scrambling the wiring destroys that normalization, which is why the scrambled brain needs 2.3 times the gain to wake up at all, and why, once awake, it spreads alerts across neurons in a way the readout finds easier to separate. Random wiring goes further in the same direction. The evolved structure is not noise. It is structure optimized for a different problem, and here that structure is a handicap.

The gain sweep says the same thing from another angle. In the biologically sparse regime, where about 10% of Kenyon cells respond to an alert as they would to an odor, the fly scored 0.807. It only approached the baselines once we drove it to nearly 60% Kenyon cell activity, well outside anything a fly experiences. The better the fly looked, the less it was behaving like a fly.

What this means for a SOC

Honestly? Not much. We did this for fun and for the hype train, and we are not going to pretend otherwise. You would not give a fruit fly the job of a SOC analyst, and now there is a number to back that up: it pages you about a lot of nothing, it misses the alerts that matter, and a model you could train during a coffee break beats it.

If there is a lesson hiding in here, it is a small one about hype. A frozen brain of 166,000 neurons plus a trained readout will learn something from almost anything, and so will most large models bolted onto a security dataset. That is not evidence the brain, or the model, is doing anything clever. Every one of the viral fly demos would have told a different story if it had shuffled its own wiring and looked. So the next time someone shows you a triage benchmark, the boring question is still the right one: what does the simplest possible model score on the same data? If nobody checked, you do not have a benchmark. You have a demo.

None of this is a knock on the connectome. The MaleCNS release is one of the great datasets of the decade, and simulating it on a laptop in ninety seconds is a small miracle of open science. The fly's brain is just very good at being a fly's brain.

What we did not do

We did not train the connectome. We did not add synaptic delays or conductance-based synapses. We did not tune the input encoding against the labels beyond a token budget and a channel count. We did not try more than one readout family. All of this is deliberate: the point was the frozen brain versus the boring model, on the boring model's terms.

We also did not use any customer data. Every alert is from Intezer's own environment, and the template alerts on the demo page are anonymized before they touch the simulator.

Try it

Fly Triage runs the whole thing in your browser. Pick one of the anonymized real alerts and watch the smell propagate from the antennal lobes into the mushroom body, then read the verdict and compare it with Intezer's. Or paste your own alert JSON: the page downloads the 20 MB connectome once and simulates it locally in a web worker. Nothing you paste leaves your machine.

Built by Intezer. Intezer's Autonomous SOC investigates every alert at forensic depth, so humans supervise outcomes instead of grinding through tickets. The fly is not on the roadmap.

Connectome: MaleCNS v1.0, HHMI Janelia FlyEM, Cambridge Connectomics, Google Research, CC-BY 4.0. LIF model after Shiu et al., Nature 2024. The scrambled-connectome finding we cite is from the PixelML "firefly" project and Oruk Labs' speech-emotion experiment.