Skip to content

detections.ai

A Palo Alto startup (formerly System Two Security) building AI tools that help detection engineers write, translate and maintain SIEM detection rules.

Visit Website ↗ + Add to Compare Claim This Company
62/100Incremental Innovator

Overview

detections.ai, rebranded from System Two Security, builds AI tooling for detection engineering: translating threat intelligence into detections, generating and tuning rules, managing detection libraries, and converting detections across platforms such as Splunk, Microsoft Sentinel and CrowdStrike’s Next-Gen SIEM. A free Community tier lets detection engineers share and reuse rules with an AI assistant and MITRE ATT&CK mapping; a paid Enterprise tier adds automated hunting, live coverage tracking against CVEs and ATT&CK, and scheduled library audits. The company has also announced “Nightwatch,” pitched as autonomous hunting and detection engineering.

Founded in 2023 in Palo Alto, California by CEO Robert Fly and CTO Prasanth Ganesan, the company raised a $7 million seed round in December 2024 led by Costanoa Ventures, with Runtime Ventures, The Hive, Webb Investment Network and individual angel investors including Scott McNealy and Frederic Kerrest, followed by an additional, undisclosed round in November 2025 led by new investors Modern Technical Fund Management and S Ventures.

The company states more than 17,000 detection engineers use its platform, a concrete if self-reported adoption figure that distinguishes it from earlier-stage peers in the same AI-for-SOC space.

Innovation Matrix Assessment

Innovation Velocity 7/10

Rebranded and shipped a free community product plus an autonomous "Nightwatch" offering while integrating across three major SIEM ecosystems within about two years of founding.

Operational Value 7/10

Targets a well-known, chronic SOC bottleneck — the backlog and skill gap in writing and maintaining detection rules — with a workflow that plugs directly into existing SIEM platforms.

Market Momentum 6/10

A claimed 17,000+ detection engineers on the platform plus two funding rounds (Dec 2024 and Nov 2025) is a concrete, if vendor-reported, adoption signal for a seed-stage company.

Category Disruption 6/10

AI-native detection authoring is a real shift from manual rule-writing, but it competes directly with several other detection-engineering-automation vendors chasing the same niche.

Real-World Efficacy 4/10

The company's own "up to 10x time savings" claim comes from unnamed design partners and has not been independently verified.

Enduring Relevance 7/10

As SIEM/XDR data volumes grow and attackers increasingly use AI, automated detection engineering should remain a relevant SOC capability for years.

Why CISOs Should Care

Reduces the manual burden on scarce detection-engineering talent and helps keep detection coverage current against new threats and CVEs.

What Makes It Different

Applies AI directly to the detection-authoring and translation workflow itself, across multiple SIEM platforms, rather than just to alert triage.

The Matrix Verdict

62/100 — INCREMENTAL INNOVATOR

An Incremental Innovator: real, fast-growing adoption in a genuine SOC pain point, but still seed-stage with efficacy claims that are self-reported rather than independently validated.

Editorial Note: Claims vs. Verified Findings

The 17,000-engineer user count and time-savings figures are company-reported; no independent benchmark of detection quality or time savings was found.

Sources