Shadow mode
Shadow mode runs automation on real inputs without letting it act, so people can compare its output with what analysts did. It is the safest way to test an agent or a migrated playbook. The test is only as good as the sample and the rule for judging a match.
What Shadow mode means
A shadow run answers whether the new system would have done the same. Define in advance how many alerts, over what period, and who decides a match.
Ask whether shadow results can be exported, since they are the parity evidence for a retirement decision.
Shadow mode in Mate Security's own words
Mate's platform page says the agent starts in shadow mode on real alerts, with a timeline from an alert at 00:00 to a verdict at 09:00 in the first 24 hours, a vendor claim. Mate Security documentation, read 2026-11-03