Thought Leadership
Business Intelligence shows what has happened. Predictive AI forecasts what could happen. Decision Intelligence goes further: it calculates which action delivers the best outcome — helping IT security teams move from a flood of data to action.
The term Decision Intelligence (DI) describes an interdisciplinary approach that combines data science with decision logic and operational implementation to analyze and optimize decision-making processes. At its core is the question: “What does the best possible decision look like?” — not based on experience or estimates, but on exact, reproducible calculations. While Business Intelligence asks “What happened?” and predictive AI delivers forecasts, DI takes the decisive next step: it calculates which measures produce the best results.
The Three Maturity Levels of Decision Support
Decision Intelligence can be implemented across three progressive maturity levels — from pure information to autonomous execution:
| Level | Description | Example in IT Security |
| Decision Support | The decision-maker uses dashboards, analyses, and alerts for information. | A security analyst monitors network traffic and security alerts via a dashboard. |
| Decision Augmentation | The system proactively recommends actions based on analyzed data. | When unusual behavior occurs, the system automatically generates recommended actions, such as blocking suspicious IPs. |
| Decision Automation | The system makes and implements decisions autonomously according to predefined rules. | The system automatically assesses the severity of incidents and initiates response measures — such as isolating affected systems. |
Why Decision Intelligence Is Critical in IT Security
The biggest challenge in cybersecurity today is no longer a shortage of data, but an overwhelming abundance of information. Security teams are confronted with thousands of individual data points — vulnerability alerts, alarms, logs — and must derive prioritized actions from them. This is where Decision Intelligence comes in.
1. From Data Overload to Decision Clarity
“More information does not automatically mean more security. Anyone who cannot derive priorities from a flood of findings gains not control, but additional complexity — which usually means less security.”
Jan Wendenburg, CEO of Onekey
Decision Intelligence helps separate signal from noise and answer the decisive questions: How quickly do we move from signal to action? How confident are we in our decisions? Which risks were already mitigated before an incident occurred?
2. Mathematical Optimization as a Key Technology
A central component of DI is mathematical optimization. Machine learning models excel at predicting what might happen next — such as rising risk exposure — but they do not provide direct recommendations for how those responsible should counteract it. Mathematical optimization, by contrast, uses deterministic methods to deliver concrete, reproducible solutions to defined problems. Unlike the statistical outputs of generative AI, these results serve as a robust foundation for security decisions. This approach is increasingly used in cybersecurity research — for example, for the robust optimization of security measures under uncertainty, or for selecting optimal measures by weighing risk against cost using mixed-integer linear programming.
3. Context as the Decisive Factor
Especially in product security, merely knowing that a vulnerability exists is not enough to determine its significance. Whether a risk is actually relevant depends on the specific firmware, the software components in use, existing protective mechanisms, the deployment context, and regulatory requirements. Decision Intelligence links technical findings with product knowledge, compliance requirements, and lifecycle information into a complete operating picture.
Human Decision Authority as a Principle
A defining feature of Decision Intelligence is that it is meant not to replace people but to empower them to make better decisions. The AI takes on the “heavy analytical lifting,” while final responsibility — especially for decisions with legal, ethical, or reputational implications — remains with humans. This is particularly important in regulated industries, where decisions must remain traceable, documented, and professionally accountable.
Case in Point: Onekey’s Decision Intelligence Approach
Onekey (Düsseldorf, founded 2020, formerly IoT Inspector) systematically applies the Decision Intelligence concept to product cybersecurity and has laid out a four-stage AI roadmap to do so. The platform analyzes firmware directly at the binary level — without source code, device, or network access — and links the technical findings with product knowledge, compliance requirements, and lifecycle information into a complete operating picture that goes beyond classic vulnerability lists.
The Four-Stage AI Roadmap at a Glance
Stage 1: The Context-Based Chat Agent
The first milestone is “Onekey AI” — a chat agent that makes security knowledge accessible in natural language. Users can ask questions about vulnerabilities, firmware, program components, software bills of materials (SBOMs), products, or OQL queries; according to the company, the answers are based directly on the platform’s analysis results.
Stage 2: Open Interfaces for Enterprise AI
In the second step, Onekey intends to open up its security data in a controlled manner for enterprise-owned AI agents, applications, and automated workflows — for example, for development environments, ticketing systems, compliance platforms, or internal AI assistants. Permissions, role models, and data sovereignty are preserved throughout.
Stage 3: The Intelligent Security Assistant
With the third milestone, the integrated AI is meant to help users contextualize the technical significance of vulnerabilities, trace their impact on software components, set priorities, and derive concrete actions. The final assessment deliberately remains with the human.
“AI is not meant to replace security professionals, but to help them understand complex relationships faster. Especially in regulated industries, decisions must remain traceable, documented, and professionally accountable.”
Jan Wendenburg, CEO of Onekey
Stage 4: Support for Operational Security Workflows
In the fourth stage, the AI agent is intended to support operational tasks: preparing technical reports, configuration tasks, managing histories, creating analysis profiles and rule sets, as well as cross-firmware comparative analyses. Here, too, critical decisions remain with the human.
Where Is the Added Value Compared to Other Platforms?
What Anyone Can Already Do Today
A fair counter-question is: why do I need Onekey for this, when generic AI assistants like ChatGPT or Claude can already be asked targeted questions about vulnerabilities in software components or CVE numbers — and when established scanners like Qualys have reliably detected vulnerabilities for over two decades? Both are true, but neither addresses the core of the problem.
A generic AI chat knows publicly documented vulnerabilities and can explain relationships between them — but it has no access to the specific firmware actually built into a product, no current SBOM of one’s own portfolio, and no ongoing link to one’s own asset base. Classic scanners like Qualys, in turn, are mature at detecting vulnerabilities but operate predominantly at the network or agent level — above the firmware layer — which makes them only of limited use for embedded devices and product firmware that cannot simply be fitted with an agent. In both cases, the actual work still falls to security professionals: translating knowledge of a vulnerability into a decision for their own infrastructure.
Other AI Vendors Are Catching Up: Specialized Security Modules
The comparison with generic AI chats like ChatGPT or Claude falls short in any case by now, because nearly every major AI vendor has meanwhile brought its own specialized vulnerability-detection modules or models to market — well beyond the classic chat interface. These systems actively scan code, attempt to validate findings in sandboxed environments, and in some cases propose patches automatically — they don’t just “explain” known knowledge, they actively search for new vulnerabilities.
Google has put Gemini 3.5 Flash Cyber (built on CodeMender, unveiled on July 21, 2026) into a pilot program for governments and select partners; in internal testing on the V8 JavaScript engine, it found more confirmed issues than Gemini 3.5 Flash and Claude Opus 4.6. OpenAI offers Aardvark (built on GPT-5, in private beta since late October 2025), an agent that continuously monitors repositories, validates findings in a sandbox, and proposes patches via Codex; in benchmarks it achieved a 92 percent detection rate and contributed to ten CVE disclosures in open-source projects.
Anthropic has Claude Security (public beta since April 30, 2026, for Enterprise customers), a comparable offering for code repositories, and is researching autonomous discovery and chaining of zero-day vulnerabilities across operating systems and browsers with its experimental Claude Mythos model — among other things, vulnerabilities for which Mozilla shipped roughly 271 fixes in a single Firefox release in April 2026.
Microsoft, in turn, bundles a Vulnerability Remediation Agent into Security Copilot, though it targets the prioritization and remediation of already-known vulnerabilities in managed enterprise environments rather than new source-code discovery.
This changes little about the core argument: all of these tools operate at the source-code, network, or repository level, and predominantly on the vendors’ own codebases or connected partner repositories — none of them holds a current SBOM of a third-party product, an ongoing link to its specific firmware, or a connection to its regulatory compliance status. That remains precisely the niche in which Onekey, Cybellum, and Finite State position themselves.
| Vendor | Module / Model | Approach | Availability (as of July 2026) |
| Google DeepMind | Gemini 3.5 Flash Cyber (CodeMender) | Active vulnerability discovery and remediation in code; per Google, competitive with larger models on CyberGym testing | Pilot program for governments/trusted partners, primarily Google’s own codebase |
| OpenAI | Aardvark (GPT-5-based) | Continuous repository scanning, sandbox validation, patch proposals via Codex | Private beta since late October 2025; 92% detection rate in benchmarks, 10 CVEs found in open-source projects |
| Anthropic | Claude Security / Claude Mythos | Repository scanning with confidence rating and patch proposal (Security); autonomous zero-day discovery across operating systems/browsers (Mythos, research model) | Claude Security: public beta since April 30, 2026, for Enterprise customers; Mythos: research preview |
| Microsoft | Security Copilot – Vulnerability Remediation Agent | Prioritization and remediation of already-known vulnerabilities in managed enterprise environments | Generally available as part of Security Copilot |
The Real Question: Closing Gaps, Not Just Knowing About Them
Knowing about a vulnerability is a commodity today. The real challenge — and the point at which Decision Intelligence must prove itself — is prioritization and remediation in the context of one’s own infrastructure: Which of the thousands of known CVEs actually affect components that are built in and reachable in my products? Which can be patched, and which can only be mitigated through compensating measures? And in what order, measured by exposure, deployment context, and regulatory relevance?
This is precisely where linking firmware analysis with product, compliance, and lifecycle context is meant to come in: not as an additional detection layer, but as a prioritization and decision layer above the raw CVE list. Whether Onekey lives up to this claim in practice depends largely on how far the third and fourth stages of the AI roadmap — the intelligent assistant and operational workflow support — are actually in productive use; both are currently still being built out. A pure chat agent at Stage 1 still differs little in practice from a well-documented knowledge base.
Just how urgently robust prioritization is needed is shown by a current figure from the Onekey Report 2025: only 32 percent of German industrial companies feel familiar with the requirements of the Cyber Resilience Act (CRA), and 38 percent have not yet initiated any measures. From September 11, 2026, initial CRA reporting obligations apply for actively exploited vulnerabilities (initial notification within 24 hours, follow-up notification after 72 hours, final report after 14 days); from December 11, 2027, affected products may only be placed on the EU market with full CRA conformity. Anyone who cannot demonstrably justify by then why and when a given vulnerability was closed has a compliance problem — regardless of how good the detection itself is.
Competitive Comparison: Onekey, Cybellum, and Finite State
A meaningful comparison is best drawn against providers that actually compete in the same market segment — product and firmware security — rather than against unrelated platforms such as classic network security or project management tools:
| Criterion | Onekey | Cybellum | Finite State |
| Focus | Product cybersecurity & compliance, headquartered in Düsseldorf | Product security for automotive, medtech, industrial sectors | Product Security OS with reachability-based prioritization |
| Analysis approach | Binary code analysis without source code, device, or network access | SBOM and vulnerability management across the entire lifecycle | Links firmware, binary code, source code, and documentation in a single system of record |
| Decision support | Four-stage AI roadmap culminating in a decision intelligence assistant | Prioritization by risk and compliance evidence | Reachability triage reduces false positives; automated threat modeling |
| Regulatory | Compliance Wizard for CRA, IEC 62443-4-2, ETSI EN 303 645, UN R155 | Industry-specific compliance workflows | SBOM lifecycle with a focus on evidentiary obligations |
Cybellum and Finite State pursue a similarly product-specific approach to Onekey and are considered, according to market observers, to be among its direct competitors. The difference lies less in analytical depth than in orientation: Onekey explicitly positions its path as a step-by-step transition from a pure information system to a decision assistant — with clearly defined maturity levels and defined human control at every stage.
SWOT Analysis: Opportunities and Risks
The biggest opportunity lies in regulation itself: the CRA will make documented, traceable security decisions mandatory from 2026/2027 onward — an environment in which a Decision Intelligence approach with built-in traceability is structurally advantaged. The biggest risk remains competitive pressure from established, better-resourced providers, as well as possible market consolidation through acquisitions.
Conclusion
Decision Intelligence marks the transition from a pure analysis era in cybersecurity to a decision-making era. It combines AI, machine learning, and mathematical optimization into an approach that not only predicts what might happen but delivers concrete recommended actions — empowering security teams to move from a flood of data to well-founded, traceable decisions.
With this approach, Onekey positions itself in a niche that is gaining importance as regulation increases. While larger competitors offer broader security platforms, its core competency lies in product-specific binary analysis and the connection of technical vulnerabilities to regulatory requirements — a distinguishing feature that is increasingly becoming a deciding criterion in regulated industries.
