Should we choose Traversal or Cleric for automated incident investigation?

Traversal models production as a graph, publishes node counts in the millions, and searches it causally with workers that act unprompted rather than waiting to be paged. Cleric is read-only by default with every investigation auditable, and accumulates operational memory across incidents.

What does it mean for workers to act unprompted?

Traversal's workers begin investigating without waiting to be paged, so the work starts on the signal rather than on a human noticing. The trade is that unprompted work has to be worth reading, or it becomes another queue.

Can Traversal run in our own cloud account?

Traversal publishes a bring-your-own-cloud deployment, which matters for teams that cannot send telemetry into a vendor tenant. Cleric publishes SOC 2 Type II and states that customer data is never used for training.

Do either of them publish accuracy figures?

Neither scores its own product against a public benchmark, though Traversal built one: ORCA-bench, with Columbia and Cornell Tech. Traversal reports 82% root-cause accuracy and Cleric 92% actionable findings, each from its own deployments. Test both on incidents whose cause you already know, because a figure from someone else's estate does not transfer to yours.

Traversal vs Cleric

Q: Does a graph-based approach see everything?

No, and this is the structural limit. Anything reasoning over a modelled graph is blind to a dependency the model does not contain, so coverage of the graph is the thing to test rather than the size of it.

At a glance

	Traversal	Cleric
Core idea	Production modelled as a graph, searched causally	Read-only investigation with an auditable trail and accumulated memory
When investigation starts	Unprompted. Workers act on the signal rather than on being paged	On the incident, with the trail reviewable afterwards
Published scale	Node counts in the millions for the modelled graph	Not published as a scale figure
Default authority in production	Read-only and agentless, with actions proposed for human approval	Read-only by default
Learning across incidents	A Production World Model updated from each incident	Operational memory, so a resolved incident informs the next
Deployment	Bring your own cloud	Vendor-hosted, SOC 2 Type II
Data handling	Telemetry stays in your cloud account	States customer data is never used for training
Published accuracy	82% root-cause accuracy, self-reported; author of ORCA-bench, a public benchmark it has not scored itself on	92% actionable findings, self-reported
Structural blind spot	A dependency absent from the graph is invisible to the search	An investigation is only as good as the signals it can read

How the two differ in practice

Both products investigate, and both are credible. They disagree about what the hard part is.

Traversal's answer is representation. If production is modelled as a graph at sufficient scale, and the graph carries the causal relationships rather than only the topology, then finding the cause becomes a search problem over that structure. The published node counts in the millions are a statement about how much of production the model is trying to hold. The workers acting unprompted follow from the same premise: if the model is good enough, there is no reason to wait for a human to notice before searching it.

Cleric's answer is trust and continuity. The hard part is getting an organisation to let an agent near production at all, and then getting engineers to keep reading its output after the first few misses. Producing a hypothesis is the easy half. Read-only by default addresses the first, the auditable trail addresses the review that follows, and operational memory addresses the second by making each investigation better than the last rather than identically cold.

In practice this produces two quite different experiences. Traversal generates work you did not ask for, which is valuable when it is right and noise when it is not. Cleric generates work you did ask for, with a record of how it got there, and gets better on your specific estate over time.

The deployment difference is more consequential than it looks. Traversal's bring-your-own-cloud option means telemetry never leaves your account, which for some organisations is the difference between a possible purchase and an impossible one. Cleric answers the same anxiety differently, with SOC 2 Type II and an explicit statement that customer data is never used for training.

Where each one is stronger

Traversal is stronger where the estate is large, interconnected, and the expensive failures are the ones that cross service boundaries. A graph is exactly the right structure for a problem where the cause and the symptom are several hops apart, and unprompted investigation is worth most where the gap between something going wrong and somebody noticing is itself a large part of the incident. Bring your own cloud makes it viable for regulated environments that cannot forward telemetry to a vendor.

Cleric is stronger where adoption is the bottleneck. Read-only by default is a much easier conversation with a security reviewer than a permissions matrix, because it is a property of the product rather than a configuration somebody has to keep correct. The auditability is the same argument extended, and it matters in environments where somebody has to sign off on what the agent did. The memory model compounds with incident volume and is the advantage a short trial will most underestimate.

Their limits mirror their designs. Anything reasoning over a modelled graph is blind to a dependency the model does not contain, which is Traversal's structural gap and one we share. Anything reading only what the estate emits is blind where nothing is emitted, which is Cleric's. Neither is a criticism, but both are worth testing for rather than discovering later.

How to choose

Test graph coverage, not graph size. A published node count says how much the model holds, not whether it holds the paths your incidents actually travel. Take three past incidents whose cause crossed a service boundary and check whether the dependency involved is in the model at all. What causal AI means for root cause analysis sets out why that coverage question is the one that decides whether causal search works on your estate.

Decide whether unprompted investigation is an asset or a queue in your organisation. It is genuinely valuable when someone reads it. Where alert fatigue is already the problem, adding a second stream of unrequested output can make things worse before it makes them better.

Then check which constraint is real for you: telemetry residency or agent authority. Traversal answers the first with bring your own cloud, Cleric answers the second with read-only by default, and most organisations find one of the two is a hard requirement rather than a preference.

Neither publishes a comparable accuracy figure, so score both yourself on incidents whose true cause you already know. The wider field, with where each tool is blind covers the rest of the category on the same terms.

NOFire AI as a third option

If telemetry residency and agent authority are both hard requirements, NOFire AI answers both. It runs read-only collectors with in-VPC processing and a bring your own cloud option. It bounds what an agent can do rather than removing the ability to act.

A policy gate checks every write before it runs, against the operations you allow and the action's predicted blast radius. It holds the action for a person, or refuses it.
The production map is time-versioned. A review can ask what the agent knew when it proposed the action, and what changed since.
Coding agents run in a microVM through brig, our open-source sandbox. The control system watches that run from outside the boundary and can stop it.
The accuracy figure is public: 89% top-1 on RCAEval, 735 scenarios, April 2026, on a dataset you can rerun.

Score it on resolved incidents the same way you score these two. Autonomy widens as the controls prove out, starting with evidence and bounded repeatable tasks with an engineer in the loop. NOFire AI vs Traversal and NOFire AI vs Cleric cover each pairing.