Cut AI
Token Costs
The Challenge
Claude is amazing at security investigation - the problem is the data you feed it. A raw firewall event has 50+ fields; 5 of them drive detections. Right now you're paying Anthropic token prices for all 50. And the same is true when AI-SOC platforms pull in more data for context.
Your AI tool is eating raw logs
AI SOC platforms and agentic workflows don't triage from thin air - they pull surrounding log context from your SIEM and data lake during every investigation. A raw Palo Alto log has 50+ fields. A threat hunt query pulls hundreds of events. Every field, every event, every investigation is a token. Most of those tokens are noise.
Token prices fell. Spend went up.
Per-token prices dropped 80% between 2024 and 2025. Enterprise AI spend rose 36% over the same period. Volume consumed per outcome is rising faster than price falls - and security AI workloads are among the heaviest users. The math only gets worse as detection engineering, threat hunting, and agentic response workflows scale.
No vendor tells you what it costs to investigate
AI SOC platforms are priced by investigation bundle or seat. A few publish a token count per investigation — Axoflow measured it. CISOs approving these tools are buying open-ended compute exposure - and that exposure scales directly with data volume and data quality.
The root cause is the same as your SIEM problem
SIEM vendors charge by ingested volume, not by detection value. AI systems charge by tokens consumed, not by signal value. In both cases, you pay full price for events that contribute nothing to security outcomes. The mechanism is different; the root cause is identical: data arriving without upstream quality control.
The Solution
Axoflow normalizes your security data once, before it reaches your SIEM, your AI SOC platform, or your data lake, with no second infrastructure layer required.
Normalize once. Every AI consumer benefits
Axoflow classifies and normalizes security data before it reaches your SIEM, your AI SOC platform, or your data lake. A raw event with 50 fields becomes a normalized OCSF record with 5 relevant fields. Every downstream system - SIEM, agent, detection engine - inherits that efficiency without each vendor having to solve it independently.
23–54% savings per correct triage
We ran Claude Opus 4.8 through triage of a security alert — 82 correlated logs across firewall, Windows auth, EDR, and cloud trail in three ways: raw vendor logs, OCSF-normalized, and OCSF pruned to detection-relevant fields. Raw logs failed every run. OCSF-curated triage cost $0.48/alert, 23% cheaper than raw; pruned cost $0.28/alert, 54% cheaper. Measure outcomes, not tokens.
More needle, less haystack
87–93% of tokens in an AI investigation are cache re-reads — the agent rereading its own prior work each turn. Anything that shortens this loop directly reduces the dominant cost. Axoflow's normalization does this two ways: the agent skips format-wrangling, and smaller per-record payloads mean a slower-growing cache.
No second infrastructure layer
You don't add an AI cost optimization tool. You normalize your security data correctly, once, in the pipeline - and every downstream system benefits. The same Axoflow deployment that reduces your SIEM ingest volume by 50% also reduces the token footprint of every AI investigation run against that data.
FAQs
What AI SOC tools does Axoflow work with?
Axoflow normalizes data upstream of any AI consumer - Anvilogic, Dropzone AI, Command Zero, Swimlane, or any agent-based workflow running against your SIEM or data lake. Because Axoflow routes to any destination, it is not tied to a specific AI SOC vendor.
Does this require changing our AI SOC tool or SIEM?
No. Axoflow sits in front of these tools, before data reaches any destination. Your existing tools receive cleaner, smaller, normalized data. No configuration changes on the AI SOC or SIEM side are required to benefit.
How does token reduction work in practice?
Raw security logs contain format overhead (JSON braces, repeated field names), irrelevant fields, and duplicate events. Normalizing to OCSF eliminates format overhead; field filtering removes irrelevant context; deduplication removes redundant events. Together, these three steps reduce the token footprint of a typical security log event by 40-90%. The reduction is largest at the investigation and threat hunting stages, where AI agents pull log context rather than pre-structured alert data.
What about alert triage? Does that also benefit?
Alert triage typically runs on structured alert data, not raw logs - so the per-event token footprint is already bounded. The large token savings come from the investigation and threat hunting stages, where AI agents pull surrounding log context from the SIEM or data lake. That is where Axoflow's upstream normalization has the most direct impact.
How much token reduction can I expect?
The exact reduction number depends on your exact data mix, but we measured 50% less tokens used when analyzing commonly used firewall data. For more verbose sources like Windows Even Logs we typically see much higher numbers.
Is this different from what our SIEM does with data parsing?
SIEMs parse data at ingest, but normalization happens inside the SIEM's own schema and for the SIEM's own queries. That normalization does not carry to downstream AI systems querying the raw event store. Axoflow normalizes before data reaches any system - so the AI consumer sees structured, field-reduced events rather than the raw record.
Does this apply to AI SOC tools we already use?
Axoflow operates upstream, before data reaches your SIEM, AI SOC platform, or data lake. Tools like Dropzone AI and Torq query your SIEM during each investigation; if that SIEM holds Axoflow-curated data, every query result is smaller and more structured. Tools like Intezer and Exaforce run a preprocessing layer before the LLM; Axoflow-curated input reduces noise at that preprocessing layer. The savings are not tied to a specific AI SOC vendor.
What is 'cost to correct triage' and why does it matter?
SIEMs parse data at ingest, but normalization occurs within the SIEM's schema and for its own queries. That normalization does not carry over to downstream AI systems querying the raw event store. Axoflow normalizes before data reaches any system, so the AI consumer sees structured, field-reduced events rather than the raw record.