Detections.ai

What Detections.ai does

Detections.ai, operated by System Two Security, Inc., is an AI-assisted detection engineering platform and community for cybersecurity professionals. The company enables security teams and individual detection engineers to share, discover, translate, and customize threat detection rules across multiple rule languages (Sigma, Suricata, YARA-L, KQL, Splunk SPL, Cortex XDR) and to map them to the MITRE ATT&CK framework. Core product surfaces include the Detections.ai Platform, the Intel Exchange (curated threat intelligence reports with associated detections), the Community Detections library (20,000+ rules), and Hive (a live activity feed of trending threats). The platform combines community contributions with AI-assisted authoring and translation to reduce redundant work, accelerate time-to-coverage for new threats, and allow knowledge to compound across organizations.

The business model is a SaaS subscription delivered under a Master Subscription Agreement to enterprise customers, with a community-led GTM that funnels a global base of 13,500+ detection engineers into paid enterprise engagements. Pricing is not publicly disclosed. The company positions itself horizontally across enterprise security teams in technology, financial services, retail, hospitality, and professional services, with named logos including Google, SentinelOne, Microsoft, IBM, Cisco, TD Bank Group, PwC, Deloitte, Target, Wynn Las Vegas, RSM US, and Optiv.

The company was founded in 2023 and is headquartered in San Francisco with 11-50 employees. In November 2025 it closed a strategic funding round led by Modern Technical Fund (MTF) with participation from SentinelOne's S Ventures, Costanoa Ventures, and Webb Investment Network. The founding team is led by Robert Fly, CEO and co-founder. The stated use of funds is enhancing AI-driven detection capabilities, particularly against AI-enabled cyberattacks.

Name

Detections.ai

Legal name

System Two Security, Inc.

Website

https://detections.ai

Company type

Private

Founded year

2023

Operating status

Operating

Headcount range

11–50 employees

Short description

Detections.ai is an AI-assisted detection engineering platform and community that enables enterprise security teams and detection engineers to share, translate, and build threat detection rules across Sigma, KQL, YARA-L, Suricata, and Splunk, mapped to MITRE ATT&CK.

Ownership category

akta.pro rank

Product category

Cybersecurity Software (Detection Engineering & Threat Intelligence Platform)

NAICS

Computer Systems Design and Related Services (54151)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Security Analytics & Detection Engineering (HDADAGAE)

Keywords

• Detection engineering platform
• Threat intelligence sharing
• Cybersecurity software
• AI-assisted detections
• MITRE ATT&CK mapping

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Platform Subscription: SaaS platform providing detection engineering capabilities to enterprise security teams under Master Subscription Agreement

Go-to-market motion1 record

Distribution channels1 record

Marketing channels4 records

Core offering

Detections.ai provides an AI-native detection engineering platform that enables security teams to author, validate, and operationalize threat detections across multiple security stacks (Splunk, Elastic, Sentinel, Chronicle, QRadar, Snowflake, Databricks). The platform includes an Intel Exchange for sharing and collaborating on threat intelligence and a community library of detections mapped to the MITRE ATT&CK framework. It targets enterprise SOC and detection engineering teams at organizations including Google, Microsoft, IBM, TD Bank Group, Deloitte, PwC, Cisco, Target, SentinelOne, Optiv, RSM US, and Wynn Las Vegas.

Product overview

Detections.ai is a detection engineering community and AI-assisted platform that enables security teams to share, discover, and build threat detections. The platform consists of the core Detections.ai Platform for collaborative detection development, the Intel Exchange for curated threat intelligence reports, and a library of 20,000+ Community Detections supporting multiple rule languages (Sigma, KQL, YARA-L, Suricata, Splunk) mapped to MITRE ATT&CK. The platform leverages AI assistance to help detection engineers build and translate rules across different security platforms and SIEM systems.

Differentiator

Problem solved

Functional benefit

Products and services

• Detections.ai Platform AI-native detection engineering platform that enables security teams to author, validate, test, and operationalize threat detections across SIEM and data lake environments. Supports multi-language detection output (SPL, KQL, Search/Alert Query, Lucene, SQL), MITRE ATT&CK mapping, and collaboration among detection engineers.
• Intel Exchange Threat intelligence sharing hub within the Detections.ai platform that lets security teams exchange, comment on, and operationalize intelligence around trending threats, surfacing the most-validated and relevant signals to detection engineers.
• Community Detections Library Catalog of community-authored detections mapped to MITRE ATT&CK techniques, giving detection engineers starting points and references when building coverage for their own SIEM/EDR environments.

Named customers12 records

Segments2 records

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability5 records

Feature5 records

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• Microsoft Sentinel: Cloud-native SIEM with built-in detection content and KQL-based rule authoring. Named Detections.ai customer yet also a broader platform competitor offering detection engineering functionality natively.
• Elastic Security: SIEM and security analytics platform with detection rules in ECS-compatible format. Broad incumbent competing in detection content while serving an overlapping enterprise SOC audience.
• Splunk Enterprise Security: Market-leading SIEM with its own detection content marketplace (Splunk Security Content) covering SPL rules. Larger incumbent with overlapping detection engineering capability but broader scope than Detections.ai.

Others

• Anomali: Threat intelligence platform that aggregates intel feeds and operationalizes IOCs. Adjacent to Detections.ai's Intel Exchange module, focused on intel ingestion rather than detection rule authoring.

Direct peers

• SOC Prime: Operates the Threat Detection Marketplace with curated Sigma rules across multiple SIEMs (Splunk, Sentinel, Elastic, Chronicle). Closest direct competitor to Detections.ai in subscription-based community detection content and cross-SIEM translation.
• Panther Labs: Modern SIEM built around detection-as-code in Python, with a community rule library. Competes both as a SIEM destination and as a detection content platform serving the same audience as Detections.ai.
• LimaCharlie: Cloud-native detection-as-code platform exposing SecOps primitives for building and sharing detection rules. Competes for the same detection engineering persona with developer-first tooling.
• Anvilogic: Detection engineering platform that lets security teams author, tune, and operationalize detections across SIEMs, with AI-assisted detection creation. Targets the same enterprise SOC audience with multi-platform detection content.
• CardinalOps: Detection engineering automation platform that recommends and optimizes detections across SIEM stacks using MITRE ATT&CK coverage analysis. Competes head-on for the detection engineering budget Detections.ai targets.
• Tidal Cyber: Threat-informed defense platform mapping detections to MITRE ATT&CK and enabling detection coverage analysis. Overlaps directly with Detections.ai's MITRE ATT&CK mapping and detection content positioning.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/detectionsai

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds1 record

Investors4 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Detections.ai