Validation

Proof, not promises.

How we measure detection, what the numbers mean, and where the limits are.

Detection accuracy

The numbers — and what they mean.

Detection accuracy is reported as area under the ROC curve (AUC), measured on held-out, labeled test data that the recognizers never saw during development. AUC measures the trade-off between detection rate and false-positive rate across all possible thresholds — a score of 1.0 is perfect; 0.5 is random.

0.995
AUC — insider trading
held-out labeled test data
0.983
AUC — prompt injection
held-out labeled test data
0
False positives on real legitimate text
real Fed + earnings transcripts
Important caveat

Balanced test-set scores flatter real-world performance. In production, genuine violations are rare against a high volume of normal traffic — which means false-positive rate matters more than it appears in a balanced test. We are explicit about this because it is how these systems are misrepresented in the market. Compiled operates as a high-recall triage layer: recognizers flag candidates for analyst review; thresholds are calibrated to your actual traffic before go-live so you tune precision and recall to your tolerance.

Real-world validation

Tested against real enforcement and real legitimate text.

A strong score on a controlled test set is necessary but not sufficient. We also validated each recognizer against independent, real-world corpora it was never built against.

Insider trading — zero false positives on legitimate text

The insider-trading recognizer was tested against real SEC and DOJ enforcement communications (positives) versus real Federal Reserve communications and public earnings-call transcripts (legitimate text, negatives). Result: zero false positives on the legitimate corpus. This matters because the failure mode for a compliance tool is not missing a violation — it is generating a queue of false alerts that analysts stop trusting. On real enforcement text, recognition held.

What real-world validation does and does not prove

These tests confirm that recognizers generalize beyond the conditions they were built in. They do not guarantee performance on your specific traffic. Your content distribution, language style, and risk population will differ from any test corpus. Calibration on your data before go-live is not optional — it is the step that converts a validated recognizer into a tuned operational tool.

False positives

The false-positive problem — and how we address it.

Alert fatigue is the failure mode we engineer against. A system that flags too much trains analysts to ignore it.

Triage layer, not a gatekeeper

Compiled recognizers are high-recall triage signals, not autonomous block-everything systems. They surface candidates for analyst review. Decisions about what to act on remain with your team.

Calibrated to your traffic before go-live

Before production, we calibrate detection thresholds against your benign traffic. You tune the precision/recall trade-off to your tolerance — not a generic setting.

Every decision is explainable

Every finding is tied to a named policy and carries a score. Analysts can see why something was flagged — which makes confirm/dismiss decisions faster and auditable.

Precision improves with your feedback

Analyst confirm/dismiss feedback during the pilot directly informs threshold tuning. The tool improves on your data without that data ever leaving your environment.

Quality gate

How every change is gated.

Every recognizer change is tested against a frozen, held-out regression suite before it ships. Detection quality is pinned: no change that regresses the score below the established floor reaches your deployment. This is a hard gate, not a review process.

01 · Frozen held-out suite

The test corpus is held out from development and never updated to match new recognizer behavior. It measures degradation, not just overall score.

02 · Score floor enforcement

If a change drops AUC below the established baseline on any in-scope recognizer, it does not ship. No exceptions.

03 · Versioned and auditable

Every recognizer update shipped to your deployment carries a version identifier and a description of what changed. You can see the history at any time.

External corroboration

Independent confirmation of the approach.

Compiled is not the only organization that has concluded an out-of-band semantic control layer is the right architecture for AI-agent governance. Two independent signals are relevant.

OWASP 2025 Top 10 for Agentic Applications

OWASP's 2025 Top 10 for Agentic Applications names the mitigation category that Compiled occupies — an out-of-band semantic inspection layer that monitors agent actions against policy before they execute. This is an independent taxonomy, not a Compiled claim. It reflects where the security research community has landed on what controls are actually needed.

Major cloud providers converging on the same model

Microsoft Entra Agent ID and AWS Bedrock AgentCore both represent the major infrastructure providers converging on the out-of-band control model: a governance layer that sits outside the agent and evaluates its actions against policy. This is corroboration that the architectural approach is correct, independent of Compiled's specific implementation.

What we don't claim

Stated plainly.

Security vendors overclaim. We would rather lose a prospect by being honest than gain one by overpromising and failing in production.

Not an autonomous gatekeeper

Compiled is a triage layer for your analysts, not a system that makes enforcement decisions on its own. Human review is part of the design.

Balanced test scores are not production guarantees

Test-set AUC scores are measured on balanced corpora. Real-world performance may be different when violations are rare against high volumes of normal traffic, which is why we calibrate to your data before go-live.

Calibration is required

A recognizer without threshold calibration on your traffic is not production-ready. We build calibration into the pilot for this reason.

Validate it yourself

The most honest proof is your own data.

The air-gapped pilot lets you run Compiled on a sample of your own traffic with zero data egress — no network connection required, no vendor relationship required. You see real verdicts on real content before committing to anything.

The full detection methodology and a benchmark brief — including held-out test design, corpus construction, calibration methodology, and per-category results — are available under NDA for customers in active evaluation.

Run an air-gapped pilot →Request the validation brief
FAQ

Questions about the numbers

Ready to look at the evidence?

Request the validation brief — the full methodology, benchmark results, and real-world test data — or start the air-gapped pilot and run it on your own traffic first.

Request the validation briefRun an air-gapped pilot →

sales@compiled.co