System Two Security runs Detections AI, a detection engineering platform for security operations teams and individual detection engineers. It combines a shared community library of detections and threat research with AI that researches threats, hunts in the customer’s own data and writes the missing detection rules.
The problem it addresses is coverage. New threats appear faster than a small team can write and test rules for them, and most teams cannot show leadership which threats they would actually catch.
At A Glance
| Vendor | System Two Security (Detections AI) |
|---|---|
| Category | Security operations, detection engineering |
| Deployment | Web platform with SAML SSO, REST API and MCP server access |
| Agentic AI | Nightwatch, AI Librarian, AI Routines, AI Assistant |
| Leadership | Robert Fly (CEO), Prasanth Ganesan (CTO) |
| Market classification | Security Operations |
What System Two Security Does
Detection engineers often work alone, rewriting rules that someone elsewhere has already written and struggling to keep coverage current as new threats appear. Detections AI is meant to end that isolation, and its approach has two layers. The community layer pools detections and intelligence so engineers can start from existing work instead of a blank page. The enterprise layer applies that pooled knowledge to one organisation’s environment and rules, so the team works on the gaps that matter to it, with finished detections managed as code.
Products
Community
Community is for practitioners who want a shared starting point. An engineer can search detections and intel reports by threat actor, CVE, technique or platform, save searches with email alerts and keep a personal detection library. Other features:
- Translation across 9 detection languages, including KQL, SPL, YARA-L, S1QL, Cortex QL and Sigma
- MITRE ATT&CK mapping and publishing
- More than 20,000 detections that can be forked and adapted
Enterprise
Enterprise serves security teams that need detection coverage they can measure and defend to leadership. It adds private team workspaces, deployment to SIEMs, AI Routines, coverage tracking and SAML SSO.
- Live coverage views by CVE, MITRE ATT&CK and historical trend
- Scheduled audits that flag stale rules, duplicate coverage and missing documentation
- One-click reports for leadership
- Detection-as-code with versioning, review and drift auditing
Intel Exchange
Intel Exchange is the public side of the community, where members publish intelligence reports, source analysis and threat research. Around 1,243 reports can be filtered by adversary, CVE, malware or tool, MITRE ATT&CK technique, contributor, publisher and category. Joining requires an invite code.
How It Works
Detections AI is a web platform reached through SAML SSO, a REST API or an MCP server.
| Component | What it does |
|---|---|
| Environment context | Enterprise uses the customer’s environment, existing detections and team preferences to judge which threats are relevant. |
| Intel ingestion | New intelligence arrives from the customer’s TIP sources as well as community Intel Exchange reports. |
| Review queue | Draft detections produced by the AI land in a queue for an engineer to approve. |
| Deployment and sync | Approved detections are pushed to SIEMs and kept in sync across detections.ai, the SIEMs and GitHub, with drift audited in one place. |
Agentic AI Capabilities
Nightwatch
Nightwatch handles hunting and detection engineering on its own. It watches for new intel, decides whether it applies to the customer, hunts the customer’s telemetry, checks the library for existing coverage and drafts detections where none exist. It updates its memory as it works and shows how it reached each finding.
AI Librarian And Bulk Operations
The AI Librarian answers plain-language questions about a team’s own detection library, such as where the gaps are for a named threat actor. Bulk AI operations run translation, tuning or audits across the whole library in one pass, for example moving a set of Sigma rules to KQL.
AI Assistant
In the Community tier, a user pastes an intel report, blog post or threat actor profile and the assistant drafts a detection, then refines it over several turns. Chat history persists between sessions, and translation relies on the platform’s own language understanding of each rule syntax.
Integrations
| Area | Integrations |
|---|---|
| SIEM and XDR | Google SecOps, Microsoft Sentinel, SentinelOne, Splunk, Cortex |
| Detection-as-code | GitHub |
Company Background
| Founded | 2023, by Robert Fly and Prasanth Ganesan |
|---|---|
| Leadership | Robert Fly (CEO) and Prasanth Ganesan (CTO) |
| Funding | A reported $7 million round in December 2024, led by Costanoa Ventures with Runtime Ventures, The Hive, Webb Investment Network and angel investors |
Note: This overview is compiled from System Two Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.