Salient Intelligence Format (SIF) v1.0¶

The Salient Intelligence Format is a purpose-built, machine-readable encoding for delivering compiled security intelligence to AI agents.

Why a New Format¶

Every existing format wastes tokens on human readability:

Format	Token Overhead	AI Parse Quality
Markdown tables	51% structural waste	Excellent
YAML	50% overhead	Excellent
Natural prose	15% filler words	Excellent
JSON	1% structural	Excellent
SIF	<5% structural	Excellent (with schema header)

SIF achieves 36% fewer tokens than prose and 60% fewer than markdown tables for the same security intelligence. When your AI agent's context window is the bottleneck, format efficiency is a capability multiplier.

Why SIF — the research behind the format

Format Overview¶

SIF uses a schema-header pattern: define abbreviations once (~60 tokens), then use compressed notation throughout. Any LLM reads the schema and understands the entire document.

Schema Header¶

@SIF/1.0
@SCHEMA org=organization ind=industry emp=employees it=IT_staff
@SCHEMA mfa=MFA_coverage smfa=strong_MFA sso=SSO_applications
@SCHEMA V=verified O=observed U=uncertain X=contradicted
@NIST ID=Identify PR=Protect DE=Detect RS=Respond RC=Recover
@SEVERITY C=critical H=high M=medium L=low
@CONFIDENCE V>O>D>U>X

Encoding Rules¶

Lines prefixed with @TAG identify section type
Key-value: key:value (no spaces around colon)
Lists: [item1,item2,item3]
Confidence: V=verified, O=observed, U=uncertain, X=contradicted
Trends: ↑=improving, →=stable, ↓=declining
Severity: C=critical, H=high, M=medium, L=low
Counts: (Nx) for times-seen
Contradictions: {declared:X actual:Y}

Three Tiers¶

SIF is compiled at three detail levels from the same twin data:

Tier 1 — Executive (~150 tokens)¶

Everything a CISO needs in one glance:

@ORG AcmeCorp ind:MFG emp:250 it:3/MSP risk:moderate
@CTRL ID:65↑ PR:48→ DE:35↑ RS:55↑ RC:42→ | Σ:52↑8/mo
@GAPS.H no-escalation-afterhours(3x,RS.CO) mfa-vpn(2x,PR.AC) edr-triage>4h(2x,DE.AE)
@X ir-plan-age{say:quarterly real:18mo}
@TRAJECTORY 5ex/30d scores:[38,42,45,49,52] Δ:+14/30d gaps:3/12res

Tier 2 — Standard (~800 tokens)¶

Consultant-level context. Adds identity posture, tool inventory, all facts by confidence, exercise history, compliance scores, coverage analysis, and recommendations.

Tier 3 — Full (~3K tokens)¶

Deep dive. Adds evidence chains for every fact, source quotes from exercises, full gap descriptions with remediation steps, event details.

Serving via MCP¶

SIF is served as MCP resources with URI-based tier and format selection:

salient://twin/executive          SIF Tier 1
salient://twin/standard           SIF Tier 2
salient://twin/full               SIF Tier 3
salient://twin/executive.md       Markdown rendering
salient://twin/schema             Schema header only

The MCP server compiles SIF on-demand from the latest twin state. Compilation is cached and invalidated by the intelligence loop.

Adaptability¶

SIF is the recommended format for AI agents. For human consumption or regulatory submissions, the same compiler produces:

Markdown — human-readable rendering at all three tiers
JSON — programmatic access for API consumers
PDF — board-ready reports (via posture report endpoint)

Implementing SIF