Israeli cybersecurity company Vega announced on Tuesday the launch of Detection Skills, an open standard designed to help security teams capture, share, and automate the reasoning used by experienced defenders to detect and investigate cyber threats.
The framework, which is available to companies regardless of whether they use Vega’s products, combines threat detection, alert triage, investigation, and continuous improvement into reusable AI-powered workflows.
Vega publicly released the framework through DetectionSkills.io and GitHub ahead of Black Hat USA 2026 in Las Vegas, where the company is demonstrating the technology.
Traditional cybersecurity systems have generally relied on detection rules that identify previously recognized patterns of malicious activity. Vega said this approach has become harder to maintain as artificial intelligence allows attackers to develop and alter their techniques more rapidly.
Detection Skills is intended to document both the conditions that should trigger an alert and the process that an experienced cyber defense engineer would follow to determine whether the alert represents a genuine threat.
New Vega standard helps security teams automate threat detection
Each “skill” can specify what evidence an AI system should examine, which activity should be escalated, and when an alert can be dismissed. The resulting investigation includes the evidence collected and an explanation of how the system reached its conclusions.
“AI-driven adversaries bypass static rules in every legacy SIEM, and no rule catches an attack it has never seen,” Vega co-founder and chief technology officer Eli Rozen said.
“Detection Skills answer with scaled AI reasoning that brings the judgment of your best cyber defense engineers to every alert, in real time,” he added. “We made the standard open to ensure the whole industry rises with it: As attacks scale, defense compounds.”
Vega said the framework does not make changes to an organization’s systems without human approval. Security engineers retain access to the AI’s reasoning, including the information it reviewed and the basis for its decisions.
The framework was built on the Agent Skills concept originally developed by artificial intelligence company Anthropic and adapted specifically for cybersecurity operations.
Vega compared the initiative to Sigma, an open format widely used to describe security detection rules. Detection Skills is intended to provide a similar common language for AI-assisted detection, triage, and investigation.
The initial release includes an Agentic Detection Library containing more than 35 skills developed by Vega Research. It also provides a sandbox where security teams can build, test, and export their own standards-compliant skills.
The framework is designed to work with existing cybersecurity infrastructure, including traditional security information and event management platforms, cloud storage systems, and data lakes. Vega said companies can adopt it without replacing their current security products or moving their data to a centralized system.
The Vega Cyber Defense Platform serves as the reference implementation of the open standard. The platform is built on Vega’s Security Analytics Mesh technology, which allows detection and investigation processes to run directly on data stored in different systems.
Rushmere Fernandes, deputy chief information security officer at Peloton, said the company had begun using the framework to encode its own internal alert-triage procedures.
“Every skill we ship gives us more explicit control over what the AI checks, escalates, and dismisses,” Fernandes said. “The result is a queue we trust: fewer false positives, and every verdict arrives with its reasoning attached.”
Shawn McGhee, chief information security officer at Exemplar Luxury Group, said the system could help retailers maintain their cybersecurity operations during periods of unusually high customer activity.
“Retail runs on peak moments, and attackers know exactly when those are,” McGhee said. “The expertise is written down, it runs on every alert, and it holds up when volume spikes.”
Lamont Orange, chief information security and trust officer at Israeli data-security company Cyera, said an open and transparent standard could help the cybersecurity industry respond collectively to increasingly capable attackers.
“An open standard for how detection decisions get made – auditable, transparent, shared – is how trust gets built at industry scale,” Orange said.
Vega was founded in 2024 and has raised $185 million from investors including Accel, Cyberstarts, Redpoint, and CRV. The company said its customers include Fortune 200 corporations, international banks, and healthcare providers.
Vega is presenting Detection Skills at Booth 3452 during Black Hat USA 2026.