What shadow mode means
The platform receives your alerts, investigates them and writes its verdict and proposed action. Nothing it proposes is executed. Your analysts work the same alerts as usual and record their own verdicts. Vendors name this differently: Mate Security calls its first autonomy level Recommend only, and Conifers describes starting with a human in the loop.
Why a small team should not skip it
A lean team is tempted to switch on automation early, because the queue is the problem. But the first weeks are when you learn where the platform is weak on your data: an integration that returns partial fields, an alert type it has not seen, a business process it misreads. Learning that while the platform only recommends costs nothing.
How to run it
- Pick three to five alert categories that make up most of your volume, for example phishing reports, suspicious sign-ins and endpoint detections.
- Connect the sources those categories need, and confirm each connection can query, not only receive.
- For two to four weeks, have analysts record their verdict before reading the platform's.
- Log every disagreement with a short reason: missing data, wrong context, wrong logic, or analyst error.
- Review disagreements weekly with the vendor.
What to measure
Keep it simple: agreement rate per category, the reasons for disagreement, how long an analyst took to check a platform verdict, and how many alerts the platform could not finish. Lesson 8 turns these into pilot metrics.
What not to do
Do not let analysts read the platform's verdict first; they will anchor on it. Do not average across categories; a platform can be excellent on phishing and weak on cloud alerts. Do not count closed alerts as success without checking a sample.
Ask about the pilot terms
Some vendors run formal proofs of concept; Dropzone AI's pricing page mentions a proof-of-concept program. Agree before you start which alert categories, data sources and success measures the pilot covers, and who owns the comparison work.
When shadow mode ends
It ends per category, not for the whole platform. When a category shows the signals in the next lesson, move it up one step. Keep the rest in shadow mode until they do.
What it costs the team
Shadow mode is not free: analysts do the work twice for a few weeks, and someone has to log disagreements. Plan for it. Many small teams pick one analyst to own the comparison and limit it to the busiest categories, which keeps the extra effort to a few hours a week while still producing evidence the team can act on.