Vega Unveils New Open Standard to Combat AI-Driven Cyberattacks
At Black Hat USA 2026, Vega introduced Detection Skills, an open standard designed to document and automate cyber threat analysis using AI. The framework allows security teams to scale expert knowledge and improve incident response.
AI-based cyberattacks are evolving at a speed that traditional defense systems struggle to keep up with, and at Vega, they believe the solution can no longer be limited to just another detection rule or an additional alert. At the Black Hat USA 2026 conference, the company unveiled Detection Skills — a new open standard designed to allow information security professionals, cyber researchers, and technology providers to document, share, and expand the professional knowledge behind the detection, analysis, and investigation of cyber threats.
According to the company, while the industry previously relied primarily on static detection rules, in an era where attackers use artificial intelligence to create and adapt new attack methods within minutes, this approach is no longer sufficient. Instead of relying only on conditions that trigger an alert, Detection Skills also records the decision-making process of cyber experts—what data they examine, how they analyze the findings, and how they reach conclusions during the investigation.
The standard is available as an open project via GitHub and the detectionskills.io website. The Vega Cyber Defense Platform serves as the reference implementation. Vega explains that each Detection Skill integrates the stages of analysis, investigation, and optimization within an AI-based workflow, ensuring that the accumulated knowledge of defense teams becomes a capability that can be consistently applied and improved over time.
Eli Rosen, co-founder and CTO of Vega, stated: "Attackers using artificial intelligence are already successfully bypassing static detection rules in traditional SIEM systems. Detection Skills brings the thought process and judgment of the most experienced cyber defense engineers to every alert using AI capabilities that operate in real-time. We chose to make the standard open so that the entire industry could benefit from it."
The standard is based on Anthropic's Agent Skills framework, adapted for the cyber world. Unlike traditional security tools, Detection Skills automatically triggers an analysis and investigation process immediately after an incident is identified. Analysts receive an investigation file including findings and documentation of the AI's decision-making process, while security engineers retain control, as the system does not make changes without the approval of an information security professional.
The first version includes a library of more than 35 Detection Skills and a Sandbox environment. Organizations such as Peloton, Exemplar Luxury Group, and Cyera have already adopted the standard.
