detections.ai
A Palo Alto startup (formerly System Two Security) building AI tools that help detection engineers write, translate and maintain SIEM detection rules.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
detections.ai, rebranded from System Two Security, builds AI tooling for detection engineering: translating threat intelligence into detections, generating and tuning rules, managing detection libraries, and converting detections across platforms such as Splunk, Microsoft Sentinel and CrowdStrike’s Next-Gen SIEM. A free Community tier lets detection engineers share and reuse rules with an AI assistant and MITRE ATT&CK mapping; a paid Enterprise tier adds automated hunting, live coverage tracking against CVEs and ATT&CK, and scheduled library audits. The company has also announced “Nightwatch,” pitched as autonomous hunting and detection engineering.
Founded in 2023 in Palo Alto, California by CEO Robert Fly and CTO Prasanth Ganesan, the company raised a $7 million seed round in December 2024 led by Costanoa Ventures, with Runtime Ventures, The Hive, Webb Investment Network and individual angel investors including Scott McNealy and Frederic Kerrest, followed by an additional, undisclosed round in November 2025 led by new investors Modern Technical Fund Management and S Ventures.
The company states more than 17,000 detection engineers use its platform, a concrete if self-reported adoption figure that distinguishes it from earlier-stage peers in the same AI-for-SOC space.
Innovation Matrix Assessment
Rebranded and shipped a free community product plus an autonomous "Nightwatch" offering while integrating across three major SIEM ecosystems within about two years of founding.
Targets a well-known, chronic SOC bottleneck — the backlog and skill gap in writing and maintaining detection rules — with a workflow that plugs directly into existing SIEM platforms.
A claimed 17,000+ detection engineers on the platform plus two funding rounds (Dec 2024 and Nov 2025) is a concrete, if vendor-reported, adoption signal for a seed-stage company.
AI-native detection authoring is a real shift from manual rule-writing, but it competes directly with several other detection-engineering-automation vendors chasing the same niche.
The company's own "up to 10x time savings" claim comes from unnamed design partners and has not been independently verified.
As SIEM/XDR data volumes grow and attackers increasingly use AI, automated detection engineering should remain a relevant SOC capability for years.
Why CISOs Should Care
Reduces the manual burden on scarce detection-engineering talent and helps keep detection coverage current against new threats and CVEs.
What Makes It Different
Applies AI directly to the detection-authoring and translation workflow itself, across multiple SIEM platforms, rather than just to alert triage.
The Matrix Verdict
62/100 — INCREMENTAL INNOVATOR
An Incremental Innovator: real, fast-growing adoption in a genuine SOC pain point, but still seed-stage with efficacy claims that are self-reported rather than independently validated.
Editorial Note: Claims vs. Verified Findings
The 17,000-engineer user count and time-savings figures are company-reported; no independent benchmark of detection quality or time savings was found.
Sources
Alternatives to detections.ai
Abnormal AI
AI-native behavioral security platform that analyzes sender identity and communication patterns, rather than message content alone, to stop…
Palo Alto Networks Cortex XSIAM
Palo Alto Networks' AI-driven 'autonomous SOC' platform that unifies SIEM, EDR, SOAR, and attack-surface data into a single…
7AI
7AI, founded by Cybereason's former CEO and CTO, deploys autonomous AI agents that triage, investigate, and correlate security…
Fenix24
Chattanooga-based ransomware recovery specialist that has restored operations after 500+ real-world incidents, including 30 Fortune 500 companies.
Sevii
CISO ReviewedAgentic AI platform positioning itself around autonomous threat elimination rather than alerting, using AI agents to investigate and…
Torq
AI-native hyperautomation platform positioning itself as an 'agentic SOC,' using a multi-agent system to autonomously execute large volumes…