Shadow mode
Shadow mode runs a platform on real alerts without letting it act, so its verdicts and proposed actions can be compared with what analysts did. It is the safest way to test containment logic. A pilot in shadow mode produces data on accuracy before any action is trusted.
Definition
Run shadow mode long enough to see rare alert types. A week of phishing alerts says little about a domain controller incident.
Exit criteria should be written in advance: agreement with analysts, false positive rate and zero actions that would have been wrong.
Shadow mode in Prophet Security's documentation
Prophet Security says its autonomous product takes only actions the customer has approved and that remediation is previewed before it runs (vendor claim). That is a preview step, and the page does not describe a shadow period on live alerts. vendor claim prophetsecurity.ai, read
The example names a vendor and its own page. A vendor's use of Shadow mode may differ from the definition above; the rubric uses the definition on this page.