ByJERUSALEM POST STAFF

AUGUST 4, 2026 16:29

Israeli cybersecurity firm Vega has introduced Detection Skills, an open standard that enables security teams to record, exchange, and automate the analytical methods used by veteran defenders when identifying and examining cyber threats.

The framework, accessible to organizations irrespective of their use of Vega solutions, integrates threat detection, alert evaluation, investigation, and ongoing refinement into modular AI-supported processes.

Vega has shared the framework openly through DetectionSkills.io and GitHub in advance of Black Hat USA 2026 in Las Vegas, where the firm is presenting the technology.

Conventional cybersecurity tools have typically depended on detection rules that flag known patterns of harmful behavior. Vega noted that this method has grown more difficult to sustain as artificial intelligence enables attackers to create and modify their methods at greater speed.

Detection Skills aims to capture both the triggers for an alert and the sequence an experienced cyber defense engineer would apply to assess whether the alert indicates a real threat.

New Vega standard helps security teams automate threat detection

Each skill outlines the evidence an AI system should review, the activity that warrants escalation, and the conditions under which an alert may be closed. The resulting investigation records the evidence gathered and explains how the system arrived at its determinations.

AI-driven adversaries evade static rules across every legacy SIEM, and no rule detects an attack it has not encountered before, said Vega co-founder and chief technology officer Eli Rozen.

Detection Skills respond with scaled AI reasoning that applies the judgment of top cyber defense engineers to every alert in real time, he added. The standard was opened to help the entire industry advance together as attacks grow, defense compounds.

Vega stated the framework avoids altering an organization systems without human approval. Security engineers keep access to the AI reasoning, including the data examined and the rationale for its decisions.

The framework builds on the Agent Skills concept first created by artificial intelligence company Anthropic and tailored for cybersecurity operations.

Vega likened the effort to Sigma, an open format commonly used to define security detection rules. Detection Skills seeks to offer a comparable shared language for AI-assisted detection, triage, and investigation.

The initial release features an Agentic Detection Library with more than 35 skills created by Vega Research. It also supplies a sandbox for security teams to develop, evaluate, and export their own standards-compliant skills.

The framework is built to integrate with existing cybersecurity infrastructure, including traditional security information and event management platforms, cloud storage systems, and data lakes. Vega indicated companies can implement it without replacing current security products or relocating their data to a central system.

The Vega Cyber Defense Platform acts as the reference implementation of the open standard. The platform relies on Vega Security Analytics Mesh technology, which permits detection and investigation processes to operate directly on data held in separate systems.

Rushmere Fernandes, deputy chief information security officer at Peloton, noted the company has started applying the framework to document its internal alert-triage procedures.

Every skill we release provides greater explicit control over what the AI examines, escalates, and closes, Fernandes said. The outcome is a queue we trust with fewer false positives and every verdict delivered with its reasoning attached.

Shawn McGhee, chief information security officer at Exemplar Luxury Group, observed the system could assist retailers in sustaining cybersecurity operations amid periods of elevated customer activity.

Retail depends on peak moments, and attackers recognize precisely when those occur, McGhee said. The expertise is documented, it operates on every alert, and it remains effective when volume increases.

Lamont Orange, chief information security and trust officer at Israeli data-security company Cyera, indicated an open and transparent standard could enable the cybersecurity industry to respond collectively to increasingly capable attackers.

An open standard for how detection decisions are made, auditable, transparent, and shared, is how trust is established at industry scale, Orange said.

Vega was established in 2024 and has secured $185 million from investors including Accel, Cyberstarts, Redpoint, and CRV. The company reported its customers include Fortune 200 corporations, international banks, and healthcare providers.

Vega is presenting Detection Skills at Booth 3452 during Black Hat USA 2026.