Prophet launches AI Detection Engineer for security teams

Prophet Security has launched AI Detection Engineer, now generally available as part of its security operations platform.

The product targets detection engineering, a security operations function that many companies struggle to staff and maintain as analysts are pulled into alert triage and incident response.

It uses AI agents to identify gaps in detection coverage, write new detections, tune existing rules and validate recommendations against an organisation's historical investigation data. It also creates a live coverage map based on the MITRE ATT&CK framework by analysing completed investigations and threat-hunting results, rather than relying on a static inventory of enabled rules.

The launch broadens Prophet's scope beyond the investigation and response work that has drawn much of the recent attention in AI for security operations. Here, the focus is the background engineering work needed to keep detection rules current and useful as threats shift and security stacks grow more complex.

Coverage gaps

Detection engineering has become a growing concern for security teams because it requires specialist skills and sustained attention. Teams must create new rules, retire or adjust ineffective ones, and check whether coverage aligns with the attack techniques seen in their environments.

Many organisations have dashboards showing which rules are turned on, but those views do not necessarily reveal whether the rules are effective in practice. By looking at completed investigations, the product is designed to distinguish between coverage that exists on paper and coverage that has proved useful in real incidents.

The workflow includes backtesting each recommendation on historical data before any implementation is proposed. Organisations can decide how much autonomy to give the system, starting with a review-and-approve approach and moving to greater automation if they choose. It also includes version control, documentation, audit trails and rollback options for detection changes.

One customer cited by Prophet said the product helped expose weaknesses in practical coverage and reduce false-positive noise.

"AI Detection Engineer gave us a real view of where our coverage actually stood, tuned our rules that were contributing to false positive noise, and proposed new detections it had already backtested against our own investigation data. That's work we simply didn't have the people or hours to do ourselves, and we decide how much autonomy to give it along the way," said Lisa Brooks, Director, Information Security - Security Operations & Engineering at ETS.

Operational focus

Prophet describes the product as an effort to turn detection engineering into a continuous process rather than an occasional project. The system reviews investigation history, detection performance and telemetry to build a prioritised set of recommendations for security teams.

That reflects a broader pressure in corporate cyber defence. Security teams are often measured on response times and incident handling, leaving less visible maintenance work under-resourced even when it directly affects future detection quality.

The product can identify telemetry blind spots, generate detections using a customer's existing security tools and adjust rules that contribute to analyst fatigue through excess false positives. The MITRE ATT&CK mapping is intended to show which techniques are effectively covered and which areas have gone quiet or remain unaddressed.

Prophet's platform already covers alert triage, investigations and threat hunting. Adding detection engineering extends it across more of the security operations workflow, in line with a wider industry push to use AI not only to handle incoming alerts but also to maintain the systems that decide which activity should be flagged in the first place.

Grant Oviatt, Co-Founder and Vice President of Product at Prophet Security, said the staffing shortage in detection engineering has made continuous improvement difficult for many teams.

"Security teams have known for years that detection engineering is essential, but they haven't had the people or the time to do it continuously," said Oviatt. "AI Detection Engineer turns detection engineering from an occasional project into a continuous operational capability. Because Prophet AI performs the investigations, it understands which detections matter most, which gaps create the greatest risk, and where teams can make the biggest improvements. Organisations remain in complete control while AI handles the work that never seems to fit into the day."

Prophet counts Accel, Bain Capital Ventures, Amex Ventures and Citi Ventures among its investors.