[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd67AWGQx2A4jIngENSDytUHqjsbriSkHInXfbQ7KDD4":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":107},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"3f701e4d-3abe-4d4b-ae47-89c07ca31d9a","Swimlane connects custom detections to AI-led investigation and response","swimlane-connects-custom-detections-to-ai-led-investigation-and-response-5547dc","Swimlane has announced new capabilities in the Swimlane Turbine platform that allow security teams to run their own detection logic against large volumes of data and send resulting alerts directly into Swimlane AI SOC for investigation and response. The October release also adds two-way Model Context Protocol (MCP) support and new Hero AI agent that uses natural-language prompts to build applications for any use case, expanding how teams can connect tools, build workflows and operationalize … More → The post Swimlane connects custom detections to AI-led investigation and response appeared first on Help Net Security.","Swimlane has released new capabilities for its Turbine platform, enabling security teams to implement custom detection logic against large datasets. These custom detections can then feed directly into Swimlane AI SOC for investigation and response, addressing emerging AI-specific threats like prompt injection and unsanctioned AI use that may be missed by commercial tools. The update also includes two-way Model Context Protocol (MCP) support and a new Hero AI agent for application building.","Swimlane Turbine platform enhances AI-led security investigation and response with custom detection capabilities.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F28\u002Fswimlane-turbine-platform-capabilities\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F11\u002F28150559\u002Fhns-large_logo.webp","2026-10-28T14:26:24+00:00","2026-10-28T15:00:09.860151+00:00",7,[17,20,22,25],{"name":18,"type":19},"Swimlane Turbine","product",{"name":21,"type":19},"Swimlane AI SOC",{"name":23,"type":24},"AI","technology",{"name":26,"type":24},"Model Context Protocol","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":27,"icon":29,"name":30,"slug":31},null,"Tools","tools",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":48,"vendors":106},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"7ai","7AI","\u002Fvendor-logos\u002F7ai.png","7ai-agentic-security-platform","7AI Agentic Security Platform","https:\u002F\u002F7ai.com\u002Fplatform","AI agents for alert triage, investigation and threat hunting in one platform for the SOC.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"intezer","Intezer","\u002Fvendor-logos\u002Fintezer.png","intezer-ai-soc","Intezer AI SOC","https:\u002F\u002Fintezer.com\u002Fproduct\u002Fai-soc","Investigates every alert at forensic depth, escalates the small share that need a person, and feeds each verdict back into detection engineering.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter","GreyMatter","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002F","Agentic security operations platform that triages, investigates and responds to alerts across existing SIEM, EDR and cloud tools, with role-based AI teammates.",{"slug":39,"name":79,"problem":80,"products":81},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[],{"slug":108,"title":109,"body":110,"framework_refs":111,"framework_notes":119},"ai-specific-threats-demand-custom-detection-and-automated-response","AI-Specific Threats Demand Custom Detection and Automated Response","As AI systems proliferate within enterprise environments, traditional commercial security tools are failing to detect emerging threats like prompt injection attacks and unsanctioned AI usage. The gap between what off-the-shelf tools cover and what AI-driven workflows actually expose creates significant blind spots for security operations teams. Swimlane's update highlights that organizations cannot rely solely on vendor-provided detection logic when novel attack surfaces are evolving faster than tool vendors can respond. Without custom detection capabilities feeding into automated investigation workflows, AI-related incidents may go undetected until significant damage has occurred. This matters because prompt injection and shadow AI use can lead to data exfiltration, policy violations, and compliance failures.",[112,113,114,115,116,117,118],"CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":120,"NIS2 Article 21(2)(b)":121,"MITRE ATT&CK T1566: Phishing":122,"NIST SP 800-53 SI-2: Flaw Remediation":123,"CIS Control 17: Incident Response Management":124,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":125,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":126},"Unsanctioned AI tools processing personal data without appropriate controls represent a failure of technical and organizational measures required under Article 32 to ensure data security.","NIS2 requires incident handling capabilities that cover emerging threat vectors; AI-specific attacks that bypass commercial tools demand the custom detection-to-response integration this update addresses.","Prompt injection attacks share a conceptual lineage with phishing in that they manipulate trusted inputs to execute unintended actions, making custom detection logic essential to catching these novel techniques.","Emerging AI vulnerabilities such as prompt injection represent known weakness classes that require active detection and remediation processes, just as software flaws do.","AI-specific threats like prompt injection require predefined incident response playbooks; without automated investigation pipelines tied to custom detections, response times lag dangerously behind novel attack techniques.","Prompt injection and unsanctioned AI use are technical vulnerabilities in AI-integrated workflows that must be actively monitored and mitigated under a structured vulnerability management program.","Unsanctioned AI use represents unauthorized access to unapproved resources; enforcing identity and access controls over AI tools would prevent employees from introducing shadow AI into the environment."]