Swimlane Closes the AI SOC Blind Spot With Customer-Defined Detections

New Turbine capabilities let security teams turn their own data and expertise into detections for AI threats that existing tools miss, such as prompt injection and unsanctioned AI use, and sends alerts directly into agentic investigation and response.

News Highlights

• Customer-defined detections: Security teams can now run their own detection logic against the data available to Turbine, processed in parallel at enterprise scale, and send resulting alerts directly into Swimlane AI SOC for investigation and response.
• AI detection and response use cases: The new capabilities help teams address emerging AI risks such as prompt injection, unsanctioned AI use and compromised guardrails, and stop unbounded AI spend from rogue agent behavior when existing security tools may not generate an alert.
• Two-way MCP support: Hero AI can use tools from third-party MCP servers, while Turbine can expose governed automation as MCP tools for external AI clients.
• Natural-language application building: Hero AI Application Builder Agent lets teams create and modify Turbine applications, record structures and workflows using natural language, with human review before changes are saved.

DENVER--(BUSINESS WIRE)--Swimlane, the leader in agentic AI automation for every security function, today announced new capabilities in the Swimlane Turbine platform that allow security teams to run their own detection logic against large volumes of data and send resulting alerts directly into Swimlane AI SOC for investigation and response. The October release also adds two-way Model Context Protocol (MCP) support and new Hero AI agent that uses natural-language prompts to build applications for any use case, expanding how teams can connect tools, build workflows and operationalize security automation.

As enterprises deploy agents, MCP servers, copilots and local models, security teams are encountering new risks that existing detection products may not recognize. Prompt injection, unsanctioned AI use, compromised guardrails and other AI-specific threats can fall outside vendor-defined detections, leaving no alert for an AI SOC to investigate. Swimlane delivers new capabilities to support AI detection and response (AIDR) use cases where AI systems themselves are the subject of the incident, giving teams a way to apply their own dynamic detection logic when commercial coverage does not exist.

You Can’t Respond to What You Don’t Detect

The AI SOC market has focused heavily on what happens after an alert is generated: how quickly AI can triage it, investigate it and determine what should happen next. But that model assumes a relevant detection already exists.

That assumption is increasingly strained as organizations introduce new AI systems, agents and workflows into their environments. Some risks are too new, too specific or too dependent on organizational context for a commercial security vendor to define in advance. The same is true outside AI. What constitutes suspicious activity for a federal agency, manufacturer, or MSSP may be so specific that it never makes it onto a vendor roadmap.

New Swimlane Turbine big data processing capabilities give security teams a way to address that gap by running their own detection logic across large volumes of data and sending resulting alerts directly into Swimlane AI SOC. A single big data action can evaluate tens of thousands of records across parallel compute nodes, making customer-defined detection practical at enterprise scale while driving greater investigation depth.

“The security industry has spent the last two years debating how autonomously AI can work an alert, but that skips a more basic question: where did the alert come from?” said Cody Cornell, Co-Founder and CEO of Swimlane. “As AI introduces new risks faster, investigation depth and quality are going to become essential, vendor-defined detections alone don’t paint the full picture, the teams closest to those environments need a way to define what matters to them. Turbine gives them that control, then connects the resulting alert directly to investigation and response.”

From Customer-Defined Logic to Investigation and Response

The new detection capabilities extend Turbine further into the detection-to-response lifecycle without replacing the security tools organizations already rely on. Swimlane continues to consume alerts from SIEM, EDR, cloud security and other technologies, while giving teams an additional way to run their own detection logic against the data available to Turbine and send resulting alerts into AI SOC for agentic investigation and governed response.

New capabilities and use cases include:

• Customer-Defined Detection Logic: Run organization-specific detection logic against large volumes of data and send resulting alerts directly into Swimlane AI SOC for investigation and response.
• AI Security Use Cases: Apply custom detections to emerging risks such as local AI model use, unsanctioned AI accounts, sensitive data submitted to AI services, prompt injection and disabled or bypassed guardrails.
• AI-Assisted Detection Authoring: Describe the detection you want and use Turbine’s playbook generation capabilities to help build the corresponding detection.
• Enterprise-Scale Processing: Evaluate tens of thousands of records in a single action across parallel compute nodes, making customer-defined detection practical at scale.

MCP Becomes a Two-Way Connection for Security Automation

The October release also expands Model Context Protocol support within Turbine in both directions, giving security teams more flexibility in how AI agents access tools and how external AI clients invoke governed automation.

New MCP capabilities include:

• Turbine as an MCP Host: Hero AI can connect directly to third-party MCP servers and use their tools during investigations and playbooks, with centralized control over authentication and access.
• Turbine as an MCP Server: External AI agents and assistants like Claude, ChatGPT, Cursor, Gemini CLI and Microsoft Copilot can invoke governed Turbine components, including multi-step playbooks, within existing role-based access controls.
• MCP + API Bridging: Turbine seamlessly combines MCP tools and APIs, connecting Swimlane’s broad range of integrations with external MCP-compatible tools and workflows.

“MCP is most useful when it becomes part of the operating model, not just another integration,” said Srikant Vissamsetti, Chief Operating Officer at Swimlane. “Turbine can use tools from external MCP servers, expose governed automation back to AI clients and combine both with the API integrations customers already rely on. That gives security teams a practical way to bring agents into real workflows without giving up the controls and automation already in place.”

Build New Security Applications by Asking Hero AI

The release also introduces a new Hero AI Agent for application building, reducing the manual work required to create and adapt the record structures, layouts and workflows that new security use cases require.

• Natural-Language Application Building: Create and modify applications, record structures, layouts and workflows by describing what is needed.
• Human-Controlled Changes: AI-generated edits remain unsaved until reviewed, with changes highlighted and the option to accept or reject them before anything persists.

Extending Agentic AI Automation Across Security Operations

These capabilities build on Swimlane AI SOC and its intelligent routing model, which directs work to deterministic automation, AI-assisted investigation or fully agentic investigation based on the level of reasoning required. Customer-defined detection adds another entry point to that model by letting teams define organization-specific conditions that should trigger investigation and response.

Rather than replacing existing detection technologies or sending every task through an AI model, Swimlane is expanding how teams can combine their own data, security expertise, AI and deterministic automation within one governed platform.

Availability

The new Swimlane Turbine capabilities, including customer-defined detection for customer-defined detection logic, two-way MCP support and Hero AI Application Builder Agent, are now generally available.

Key Resources

• Learn more about Swimlane Turbine: swimlane.com/swimlane-turbine/
• Request a demo: swimlane.com/demo
• Register for our upcoming webinar AI Reasoning Meets Reliability: An Operating Model for the SOC on Thursday, November 12 at 11:00 A.M ET.

About Swimlane

At Swimlane, we believe the convergence of agentic AI and automation can solve the most challenging security, compliance and IT/OT operations problems. With Swimlane, enterprises and MSSPs benefit from the world's first and only AI automation platform for every security function. Only Swimlane gives you the scale and flexibility to unify security teams, tools and telemetry, ensuring today's SecOps are always a step ahead of tomorrow's threats.

Learn more: swimlane.com