How it works security alert → investigation for DART decision.
Trigger investigation An alert enters a structured Notion database.[Source 1
Gather and correlate Scruff follows the matching runbook and queries security sources through MCP.[Source 1
Return findings DART reviews the investigation and decides whether to declare an incident or dismiss the alert.[Source 1
Where people stay involved People review, approve, or guide the agent’s work here.
Supervision level
Work-product review
A person reviews the draft or implementation.
3/5 Level 3 of 5
security alert → investigation for DART decision[Source 1 How supervision levels work
Implementation details Model Not reported Harness Notion Custom Agents.[Source 1 Sandbox Not reported Tool access MCP connections to external security tools.[Source 1 Knowledge Runbooks stored as Notion pages.[Source 1 Context management A notes page retains lessons and accepts human edits.[Source 1 Credentials Not reported Interfaces Not reported Validation and failure handling Not reported: The available sources do not describe how the team checks the output.
Reported observations These results come from the sources. Notes below each result explain what it covers and any reported limits.
Key observation Notion reports more than six hours saved per week across DART.[Source 1
Reported by Notion Scope Scruff: Notion reports more than six hours saved per week across DART. The source does not report the denominator of this figure.
About this result Category Adoption output Evidence type Reported measurement What it covers Scruff: Notion reports more than six hours saved per week across DART. Lessons Not reported: The available sources do not report lessons from this work.
Back to agents Sources and research details Citations link to the original publisher. Each source also keeps a preserved copy in the repository, so a changed or removed page stays checkable.
Meet Scruff, Security’s New AI Teammate https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate Engineering blog · First party · Last source verification: 2026-09-17 Question coverage and scope purpose Reported workflow Reported human involvement Reported implementation Reported validation Not reported observations Reported lessons Not reported Research details for every claim on this page Summary Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Harness Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Knowledge Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Context management Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Tool access Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Trigger investigation Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Gather and correlate Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Return findings Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Key observation Statement type Metric Provenance Reported Confidence Medium Confidence reason Self-reported by the source; no independent verification. Reported by Notion Scope Scruff: Notion reports more than six hours saved per week across DART. Denominator Not reported Method Not reported Observation date Not reported Operating model assessment Statement type Inference Provenance Catalog judgment Confidence Medium Confidence reason The source explicitly places the incident/false-positive decision with DART after Scruff gathers and analyzes evidence. Observation date 2026-01-12 