Swimlane addresses AI SOC blind spots with customer-defined detections. ET By Editorial Team October 29, 2026 Swimlane, the leader in agentic AI automation for every security function, announced new capabilities in the Swimlane Turbine platform that allow security teams to run their own detection logic against large volumes of data and send resulting alerts directly into Swimlane AI SOC for investigation and response. The October release also adds two-way Model Context Protocol (MCP) support and new Hero AI agent that uses natural-language prompts to build applications for any use case, expanding how teams can connect tools, build workflows and operationalize security automation. As enterprises deploy agents, MCP servers, copilots and local models, security teams are encountering new risks that existing detection products may not recognize. Prompt injection, unsanctioned AI use, compromised guardrails and other AI-specific threats can fall outside vendor-defined detections, leaving no alert for an AI SOC to investigate. Swimlane delivers new capabilities to support AI detection and response (AIDR) use cases where AI systems themselves are the subject of the incident, giving teams a way to apply their own dynamic detection logic when commercial coverage does not exist. You Can't Respond to What You Don't Detect The AI SOC market has focused heavily on what happens after an alert is generated: how quickly AI can triage it, investigate it and determine what should happen next. But that model assumes a relevant detection already exists. That assumption is increasingly strained as organizations introduce new AI systems, agents and workflows into their environments. Some risks are too new, too specific or too dependent on organizational context for a commercial security vendor to define in advance. The same is true outside AI. What constitutes suspicious activity for a federal agency, manufacturer, or MSSP may be so specific that it never makes it onto a vendor roadmap. New Swimlane Turbine big data processing capabilities give security teams a way to address that gap by running their own detection logic across large volumes of data and sending resulting alerts directly into Swimlane AI SOC. A single big data action can evaluate tens of thousands of records across parallel compute nodes, making customer-defined detection practical at enterprise scale while driving greater investigation depth. "The security industry has spent the last two years debating how autonomously AI can work an alert, but that skips a more basic question: where did the alert come from?" said Cody Cornell, Co-Founder and CEO of Swimlane. "As AI introduces new risks faster, investigation depth and quality are going to become essential, vendor-defined detections alone don't paint the full picture, the teams closest to those environments need a way to define what matters to them. Turbine gives them that control, then connects the resulting alert directly to investigation and response." From Customer-Defined Logic to Investigation and Response The new detection capabilities extend Turbine further into the detection-to-response lifecycle without replacing the security tools organizations already rely on. Swimlane continues to consume alerts from SIEM, EDR, cloud security and other technologies, while giving teams an additional way to run their own detection logic against the data available to Turbine and send resulting alerts into AI SOC for agentic investigation and governed response. New capabilities and use cases include: * Customer-Defined Detection Logic: Run organization-specific detection logic against large volumes of data and send resulting alerts directly into Swimlane AI SOC for investigation and response. * AI Security Use Cases: Apply custom detections to emerging risks such as local AI model use, unsanctioned AI accounts, sensitive data submitted to AI services, prompt injection and disabled or bypassed guardrails. * AI-Assisted Detection Authoring: Describe the detection you want and use Turbine's playbook generation capabilities to help build the corresponding detection. * Enterprise-Scale Processing: Evaluate tens of thousands of records in a single action across parallel compute nodes, making customer-defined detection practical at scale. MCP Becomes a Two-Way Connection for Security Automation The October release also expands Model Context Protocol support within Turbine in both directions, giving security teams more flexibility in how AI agents access tools and how external AI clients invoke governed automation. New MCP capabilities include: * Turbine as an MCP Host: Hero AI can connect directly to third-party MCP servers and use their tools during investigations and playbooks, with centralized control over authentication and access. * Turbine as an MCP Server: External AI agents and assistants like Claude, ChatGPT, Cursor, Gemini CLI and Microsoft Copilot can invoke governed Turbine components, including multi-step playbooks, within existing role-based access controls. * MCP + API Bridging: Turbine seamlessly combines MCP tools and APIs, connecting Swimlane's broad range of integrations with external MCP-compatible tools and workflows. "MCP is most useful when it becomes part of the operating model, not just another integration," said Srikant Vissamsetti, Chief Operating Officer at Swimlane. "Turbine can use tools from external MCP servers, expose governed automation back to AI clients and combine both with the API integrations customers already rely on. That gives security teams a practical way to bring agents into real workflows without giving up the controls and automation already in place." Build New Security Applications by Asking Hero AI The release also introduces a new Hero AI Agent for application building, reducing the manual work required to create and adapt the record structures, layouts and workflows that new security use cases require. * Natural-Language Application Building: Create and modify applications, record structures, layouts and workflows by describing what is needed. * Human-Controlled Changes: AI-generated edits remain unsaved until reviewed, with changes highlighted and the option to accept or reject them before anything persists. Extending Agentic AI Automation Across Security Operations These capabilities build on Swimlane AI SOC and its intelligent routing model, which directs work to deterministic automation, AI-assisted investigation or fully agentic investigation based on the level of reasoning required. Customer-defined detection adds another entry point to that model by letting teams define organization-specific conditions that should trigger investigation and response. Rather than replacing existing detection technologies or sending every task through an AI model, Swimlane is expanding how teams can combine their own data, security expertise, AI and deterministic automation within one governed platform.

Today, Swimlane announced it has raised a $40M growth round to deliver hyper automated security operations.