⚠
Incident severity & notify classifier
SecurityClassify a security incident into a severity level and the notifications it triggers — GDPR 72h, customers, regulators — fast, at 3am.
The routing recipe
Job typeClassification / routingPolicyFastest that passes
routes to
GPT-OSS 20B groq
groq:openai/gpt-oss-20b
92.7
match score
84.6
task fit
100
cost
96.4
speed
Why this model from benchmarks & capabilities
- "Classification / routing" leans hardest on instruction; GPT-OSS 20B scores 78/100 there — #23 of 40.
- Strength on this class of work shows up on IFEval, MMLU (zero-shot), where OpenAI (open-weight) models are competitive.
- Cost: free tier. Speed: ~1000 tok/s on Groq LPU.
- Chosen over Llama 3.1 8B Instant for higher task-fit (84.6 vs 75.6) & cheaper.
| Capability the job needs | Weight | GPT-OSS 20B | Catalog rank |
|---|---|---|---|
| instruction | 0.90 | #23 of 40 | |
| speed | 0.90 | #1 of 40 | |
| knowledge | 0.30 | #26 of 40 |
Relevant benchmarksIFEval MMLU (zero-shot)
EconomicsCost: free tier.
Speed: ~1000 tok/s on Groq LPU. vs runner-upChosen over Llama 3.1 8B Instant for higher task-fit (84.6 vs 75.6) & cheaper. (Llama 3.1 8B Instant, score 86.3)
Speed: ~1000 tok/s on Groq LPU. vs runner-upChosen over Llama 3.1 8B Instant for higher task-fit (84.6 vs 75.6) & cheaper. (Llama 3.1 8B Instant, score 86.3)
Example result
Sample input ▾
An employee laptop with a synced copy of a customer export (names + emails, no financial data) was stolen; the disk was unencrypted.
Severity: SEV2 — confirmed loss of personal data, limited sensitivity, bounded scope.
Personal data: Yes (names + emails).
Notifications: GDPR — likely notifiable to the supervisory authority within 72h (assess risk to individuals; low-but-not-negligible); affected customers — prepare a notice, send if risk is more than minimal; law enforcement — file a theft report.
First action: remote-wipe the device, rotate the employee’s credentials/sessions, and start the 72h clock now. Escalate to DPO/legal.
Test it on your own data