[{"data":1,"prerenderedAt":633},["ShallowReactive",2],{"uc-detection-engineering-assistant":3,"uc-regulations":415},{"useCase":4,"evidence":211,"blitsAiDeployments":306,"benchmarks":307,"indicative":324,"related":327,"indexability":413,"includeUnpublished":217},{"title":5,"shortTitle":6,"seoTitle":7,"metaDescription":8,"status":9,"definition":10,"aliases":11,"industries":17,"functions":20,"patterns":22,"channels":26,"audience":29,"autonomy":30,"adoptionStage":31,"problem":32,"problemStats":33,"howItWorks":34,"valueDrivers":35,"kpis":39,"indicativeValue":44,"macroEstimates":86,"feasibility":87,"implementation":102,"risk":148,"blitsAi":187,"faq":189,"related":202,"datePublished":206,"dateModified":206,"lastVerified":206,"changelog":207,"slug":210},"AI for detection engineering and detection rule writing","Detection engineering","AI detection engineering and rule writing","AI that drafts, tests and tunes detection rules for an engineer to approve. Amazon reports a 336% productivity gain; Databricks reports 60% to 80% less time at SAP.","published","AI detection engineering drafts, tests and tunes the rules that find attacks in security logs, from threat reports, vulnerability disclosures or plain language requests, for an engineer to approve. It also translates rules between query languages, tags them with MITRE ATT&CK techniques and checks them against the organization's own data before they go live.",[12,13,14,15,16],"AI detection rule generation","detection as code with AI","AI detection engineer","SIEM rule writing with AI","threat report to detection",[18,19],"cross-industry","technology",[21],"security-operations",[23,24,25],"code-generation","agentic-workflow","classification-and-routing",[27,28],"internal-tools","api","employee-facing","copilot","emerging","A detection is the rule or query that turns raw logs into an alert: a sequence of events that means\nsomebody is abusing an account, an exploit hitting a web server, a tool that attackers use to move\nbetween machines. New attacker behaviour is published every day in threat reports and vulnerability\ndisclosures, and each item has to become a detection in the language of each platform the security\nteam runs, be tested against real traffic and be tuned until it stops producing false alerts.\n\nAmazon describes the manual process for a new vulnerability. An analyst finds public proof of concept\nexploit code, studies it, writes a rule, writes queries to measure the rule's accuracy against traffic\nlogs, tunes it to reduce false positives, repeats until it is good enough, and then sends it to another\nengineer for code review. The time that takes meant the team \"had to carefully prioritize which\nvulnerabilities to cover first\".\n\nPlatform changes add a second backlog. SAP Enterprise Cloud Services describes manual detection\nengineering that consumed analyst time, tuning rules to cut false positives as \"an ongoing drain on\nresources\" and limited MITRE ATT&CK coverage on a legacy SIEM, which made it hard to measure progress.\nmnemonic, which runs detections on several platforms, says that every new piece of attacker knowledge\nhas to be read, placed in a taxonomy, expressed in the right query language, tested and checked\nagainst what already exists.",[],"1. **Intake.** The system takes a trigger: a newly disclosed vulnerability with example exploit code,\n   a threat report from a feed, a gap in coverage against MITRE ATT&CK, or a plain language request\n   from an engineer. Items are ranked, for example by exploit content and threat intelligence.\n2. **Check what already exists.** An agent queries the detection inventory (for example through an\n   MCP server) to see whether the behaviour is already covered, and writes down the gap.\n3. **Draft candidates.** A generation step writes one or several candidate rules in the query language\n   of the target platform, with metadata such as ATT&CK technique, data sources, expected false\n   positives and tuning notes. Reusable skills or templates hold the house format.\n4. **Evaluate and test.** A separate judge model scores each rule, for example for how likely it is to\n   miss the attack and how likely it is to match something that only resembles it. Rules are run against\n   historical logs and known attack samples, and rules that fail go back to the generation step with the\n   reason.\n5. **Human review.** An engineer reads the logic, the test results and the false positive estimate,\n   edits it and approves. Merge, deployment and the rollout to production follow the normal peer review\n   and change process.\n6. **Tune from feedback.** Alert outcomes from analysts feed back into recommendations to tighten or\n   retire rules.",[36,37,38],"employee-productivity","speed","risk-reduction",[40,41,42,43],"productivity-gain","handling-time-reduction","false-positive-reduction","hours-saved",{"referenceOrg":45,"inputs":46,"formula":81,"currency":82,"period":83,"resultLabel":84,"caveat":85},"A security team of an enterprise with two to six detection engineers and a SIEM",[47,53,60,67,74],{"key":48,"label":49,"low":50,"high":51,"unit":48,"note":52},"engineers","Detection engineers",2,6,"Editorial assumption for a large enterprise. Replace with your own headcount.",{"key":54,"label":55,"low":56,"high":57,"unit":58,"note":59},"shareOnRules","Share of an engineer's working year spent writing, translating and tuning rules",0.4,0.7,"fraction of working time","Editorial assumption, replace with a time study from your own team.",{"key":61,"label":62,"low":63,"high":64,"unit":65,"note":66},"hoursPerYear","Working hours per engineer per year",1600,1800,"hours","Editorial assumption that allows for leave and meetings.",{"key":68,"label":69,"low":70,"high":71,"unit":72,"note":73},"timeSavedShare","Share of rule work the AI saves",0.2,0.5,"fraction of rule work","Well below the figures on this page, where Databricks reports a reduction of 60% or more at SAP Enterprise Cloud Services and Amazon reports a 336% productivity advantage. Both include a platform change or a purpose built system, and neither is an independent measurement.",{"key":75,"label":76,"low":77,"high":78,"unit":79,"note":80},"costPerHour","Fully loaded cost of an engineer hour",80,130,"USD per hour","Editorial assumption, replace with your own fully loaded cost.","engineers * shareOnRules * hoursPerYear * timeSavedShare * costPerHour","USD","per year","Engineer time released from rule work, valued at cost","Counts engineer time only. It leaves out the cost of the AI and the test environment, the time to review every draft, the value of covering vulnerabilities that would otherwise get no rule, and the cost of a rule that misses an attack or floods analysts with alerts.",[],{"complexity":88,"complexityNote":89,"dataPrerequisites":90,"integrations":96},"high","A detection pipeline needs a detection inventory with metadata, a test bed of historical logs or replayed attack traffic, and a peer review process that already treats rules as code. Without those, the AI has nothing to check its drafts against, and the review load moves to the engineers. Each target platform adds its own query language and its own tests.",[91,92,93,94,95],"An inventory of existing detections with owners, status and MITRE ATT&CK mapping","Historical log data or replayable traffic to measure how often a rule fires and on what","Labelled examples of true attacks (exploit samples, red team and purple team results)","A feed of threat reports and vulnerability disclosures","Past alert dispositions, so the system can learn which rules produce false positives",[97,98,99,100,101],"SIEM or data lake where rules run (for example Splunk, Microsoft Sentinel, Elastic or Databricks)","Code repository and CI pipeline for detections as code","Threat intelligence feed or platform","Ticketing or case management, for alert feedback","MITRE ATT&CK data and the organization's data source catalogue",{"steps":103,"guardrails":122,"humanInTheLoop":128,"kpisToInstrument":129,"failureModes":135},[104,107,110,113,116,119],{"title":105,"detail":106},"Put the detections in a repository first","Store every rule as code with metadata (owner, ATT&CK technique, data sources, status), a test and a review step. Amazon describes the best drafted rule entering code review, just as before, and mnemonic says an analyst reviews each draft before it is merged, so the review pipeline has to exist before the AI joins it.",{"title":108,"detail":109},"Build the test bed","Assemble historical logs and a set of known malicious samples. Every generated rule must report how often it fires on normal traffic and whether it catches the sample, before an engineer sees it.",{"title":111,"detail":112},"Start with a narrow class of rules","Pick one platform and one kind of detection, such as rules for newly disclosed web vulnerabilities or translation of existing rules between two query languages. Compare drafts with rules your team wrote for the same inputs.",{"title":114,"detail":115},"Separate writing from judging","Use a second model or a set of checks to score the output of the first, as Amazon does, and send failures back with the reason. A generator that grades its own work tends to approve it.",{"title":117,"detail":118},"Measure engineer time and rule quality together","Track hours per rule and the false positive rate of rules after release. A team that writes more rules and receives more noise has moved the work to the analysts.",{"title":120,"detail":121},"Widen to tuning and gap analysis","Once drafting is trusted, let the system propose tuning changes from alert outcomes and list coverage gaps against ATT&CK. Keep the engineer's approval on every change that reaches production.",[123,124,125,126,127],"No generated rule is deployed without review and approval by a detection engineer","Every draft is tested against historical logs and attack samples before review, with the results attached","Exploit code and threat reports are treated as untrusted input to the model, and the agent has no deployment rights","Generated rules carry their source, the model and the version that wrote them, in the repository history","Rules that fire above an agreed rate in test are blocked automatically","The engineer reviews the logic, the tests and the estimated noise, and decides whether a rule ships. Amazon states that human judgment remains the final gate before production deployment and describes the analyst's job as shifting from authoring to review. In the manual process every rule went to code review by another security engineer, and Amazon says the best RuleForge rule still enters code review, just as before.",[130,131,132,133,134],"Engineer hours per production rule, by rule type","Share of drafted rules approved unchanged, edited and rejected","False positive rate of released rules after 30 days","Time from vulnerability disclosure or threat report to a deployed detection","Share of prioritized vulnerabilities and ATT&CK techniques with a tested detection",[136,139,142,145],{"title":137,"detail":138},"A plausible rule that is wrong","A generated rule can misread a report, over generalise a behaviour or look right and flood analysts with false alerts. mnemonic says this is why every output is treated as a draft that needs validation. Test against real traffic, and measure the rate after release.",{"title":140,"detail":141},"A rule that is too narrow","A rule built from a single exploit sample catches that sample and misses variants. Ask the judge step to score sensitivity as well as specificity, and add variants to the test set.",{"title":143,"detail":144},"Reviewers become the bottleneck","When drafting is cheap, review queues grow. Limit the number of open drafts per engineer and rank them by risk, so the reviewers see the best candidates first.",{"title":146,"detail":147},"Invented framework details","Models can invent ATT&CK techniques or log fields. mnemonic reports that models invented MITRE techniques in its 2023 attempt. Validate identifiers and field names against the framework and the data catalogue in a script.",{"euAiAct":149,"regulations":152,"guidance":158,"controls":176,"incidents":182},{"tier":150,"basis":151},"minimal","Generating detection rules for an organization's own cyber defence is not an Annex III use, and recital 55 of the AI Act says components used solely for cybersecurity purposes do not qualify as safety components. The tier stays minimal while engineers approve each rule and the rules do not themselves decide on people, for example by scoring employees.",[153,154,155,156,157],"eu-ai-act","nis2","dora","nist-ai-rmf","iso-42001",[159,165,170],{"title":160,"issuer":161,"region":162,"url":163,"note":164},"MITRE ATT&CK","MITRE","global","https:\u002F\u002Fattack.mitre.org\u002F","The shared catalogue of attacker techniques that detections are mapped to; use it as the reference to validate technique identifiers and to measure coverage.",{"title":166,"issuer":167,"region":162,"url":168,"note":169},"OWASP Top 10 for LLM Applications","OWASP","https:\u002F\u002Fgenai.owasp.org\u002Fllm-top-10\u002F","Lists prompt injection and excessive agency among the main risks of LLM applications, relevant when a model reads exploit code and threat reports and writes code that will run in production.",{"title":171,"issuer":172,"region":173,"url":174,"note":175},"NIST AI Risk Management Framework","NIST","north-america","https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","A voluntary framework for mapping, measuring and managing the risks of an AI system, useful for documenting the review and test regime around generated rules.",[177,178,179,180,181],"Detections stored as code with a named owner and a change history","Mandatory peer review and approval before any generated rule is deployed","Automated tests against historical logs and attack samples, with a release threshold for noise","Validation of framework identifiers and field names by script","Monthly review of released rules for false positive rate and missed attacks",[183],{"title":184,"url":185,"note":186},"mnemonic's first attempt to extract structured data from threat reports (2023)","https:\u002F\u002Fwww.mnemonic.io\u002Fresources\u002Fblog\u002Fagentic-detection-engineering-turning-threat-reports-into-detections\u002F","The security services company reports that its 2023 experiment with language models on threat intelligence reports was not good enough for production, because the models invented MITRE techniques, could not take long reports and gave inconsistent answers.",{"howToBuild":188},"On Blits.ai this is an **agentic workflow** that an API token or a **schedule** starts when a new\nvulnerability or report arrives. **Custom functions** call the threat feed, the detection repository\nand the test environment, and an **MCP** server can expose the detection inventory so the agent can\ncheck what is already covered. The workflow drafts candidate rules, and a second agent step with its\nown instructions judges them. A **knowledge base** with hybrid retrieval holds the house rule format,\nATT&CK mappings and examples of approved rules.\n\nA **human in the loop** approval step sits before anything is written to the repository, and a\n**tool execution policy** keeps the agent from touching production systems, so deployment stays\nwith your CI pipeline and your engineers. Each run keeps a **full audit trail** with downloadable\nrun data. **Test suites** can replay known exploit samples and normal traffic descriptions against the\nworkflow with deterministic or LLM based grading. The platform is model agnostic, with EU and UAE data\nresidency for teams that cannot send security data elsewhere.",[190,193,196,199],{"question":191,"answer":192},"How much faster can AI write detection rules?","Amazon reports that its RuleForge system gave a 336% productivity advantage over manual rule creation over four months, and Databricks reports that SAP Enterprise Cloud Services cut detection engineering time by 60% to 80%. Both are the organizations' or vendor's own measurements. Measure hours per production rule in your own team before you set a target.",{"question":194,"answer":195},"Can AI deploy detection rules by itself?","The teams on this page do not let it. At Amazon a human gives the final approval, and mnemonic's analysts review each draft and decide whether to merge it. A generated rule can look plausible and still flood analysts with false positives, so deployment stays with an engineer and your CI process.",{"question":197,"answer":198},"How do you stop AI written rules from creating more false alerts?","Test each rule against historical logs before review and set a noise threshold for release. Amazon uses a separate judge model that scores each rule, and reports that it reduced false positives by 67% with the same number of true positives. That figure measures how the judge screens candidate rules during evaluation, not alerts after release, so keep measuring the rate after release.",{"question":200,"answer":201},"Is this the same as security alert triage?","No. Triage works on alerts that rules have already produced, while detection engineering writes and tunes the rules that produce them. The two connect through feedback: triage outcomes show which rules are noisy and which attacks were missed.",[203,204,205],"security-alert-triage-and-investigation","threat-intelligence-collection-and-reporting","software-vulnerability-remediation","2026-10-13",[208],{"date":206,"note":209},"First published","detection-engineering-assistant",[212,239,277],{"title":213,"useCases":214,"organization":215,"vendors":221,"summary":224,"stage":225,"year":226,"channels":227,"languages":228,"metrics":230,"outcomeDisclosed":217,"sources":231,"verification":234,"grade":236,"id":237,"organizationSlug":238},"mnemonic: agentic workflow that turns threat reports into draft detections",[210],{"name":216,"anonymized":217,"country":218,"region":219,"industry":19,"wikidata":220},"mnemonic",false,"NO","europe","Q60760694",[222],{"name":216,"role":223},"in-house","mnemonic, a Norwegian security services company, describes an agentic workflow that reads threat intelligence reports, lists the attacker behaviours worth detecting, checks its detection inventory through an MCP server to see what is already covered and drafts a detection in its common model, with platform specific logic and tests produced by reusable skills. Analysts review every draft before it is merged. The company says an attempt in 2023 failed because the models invented MITRE techniques, and it publishes no figures for the current workflow.","pilot",2026,[27],[229],"en",[],[232],{"url":185,"title":233,"publisher":216},"Agentic detection engineering: turning threat reports into faster detections",{"level":235,"checkedAt":206},"source-verified","B","mnemonic-agentic-detection-engineering",null,{"title":240,"useCases":241,"organization":242,"vendors":246,"summary":249,"stage":250,"year":251,"channels":252,"languages":253,"metrics":254,"outcomeDisclosed":268,"sources":269,"verification":274,"grade":236,"id":275,"organizationSlug":276},"Amazon: RuleForge agents that write detection rules from vulnerability exploit examples",[210],{"name":243,"anonymized":217,"country":244,"region":173,"industry":19,"wikidata":245},"Amazon","US","Q3884",[247],{"name":248,"role":223},"Amazon Web Services","AWS security engineers built RuleForge, a set of specialised agents that ingest and prioritise newly disclosed vulnerabilities, generate a detection rule from example exploit code, score each rule with a separate judge model for sensitivity and specificity, test it in stages and return failures to the generation agent with feedback. A human reviews and approves every rule before deployment. Amazon reports that over the last four months of the year the team produced and validated rules 336% faster than by hand, and that the judge model cut false positives by 67%.","production",2025,[27],[229],[255,264],{"kpi":40,"value":256,"unit":257,"qualifier":258,"period":259,"baseline":260,"claimant":261,"quote":262,"sourceUrl":263},336,"percent","exact","rule creation and validation over the final four months of the year","manual rule writing by security analysts","organization","At AWS, we built RuleForge, an agentic-AI system that generates detection rules directly from examples of vulnerability-exploiting code, achieving a 336% productivity advantage over manual rule creation while maintaining the precision required for production security systems and enhanced customer security.","https:\u002F\u002Fwww.amazon.science\u002Fblog\u002Fhow-amazon-uses-agentic-ai-for-vulnerability-detection-at-global-scale",{"kpi":42,"value":265,"unit":257,"qualifier":258,"period":266,"claimant":261,"quote":267,"sourceUrl":263},67,"generated rules scored by a dedicated judge model, compared with the generation model scoring its own rules","Using a dedicated judge model reduced false positives by 67% while maintaining the same number of true positive detections.",true,[270],{"url":263,"title":271,"publisher":272,"date":273},"How Amazon uses agentic AI for vulnerability detection at global scale","Amazon Science","2026-04-08",{"level":235,"checkedAt":206},"amazon-ruleforge-detection-rule-generation","amazon",{"title":278,"useCases":279,"organization":280,"vendors":283,"summary":289,"stage":250,"year":251,"channels":290,"languages":291,"metrics":292,"outcomeDisclosed":268,"sources":300,"verification":303,"grade":304,"id":305,"organizationSlug":238},"SAP Enterprise Cloud Services: AI assisted detection engineering with Anvilogic on Databricks",[210],{"name":281,"anonymized":217,"country":282,"region":219,"industry":19},"SAP Enterprise Cloud Services","DE",[284,287],{"name":285,"role":286},"Anvilogic","platform",{"name":288,"role":286},"Databricks","SAP Enterprise Cloud Services runs a private cloud of more than 200,000 virtual machines. It moved its threat detection from a legacy SIEM to Databricks and uses Anvilogic's AI to translate detections from SPL to SQL, generate modular detection logic tagged with MITRE ATT&CK metadata, recommend tuning changes from historical patterns and validate rules against its own data before deployment. Databricks reports that detection engineering time fell by 60 to 80% and that rules are created and deployed five to six times faster.",[27],[229],[293],{"kpi":41,"value":294,"unit":257,"qualifier":295,"period":296,"claimant":297,"quote":298,"sourceUrl":299},60,"at-least","detection engineering time after moving to Anvilogic and Databricks","vendor","Detection engineering time has been reduced by 60-80%, freeing analysts to focus on higher-value investigative work.","https:\u002F\u002Fwww.databricks.com\u002Fcustomers\u002Fsap\u002Fanvilogic",[301],{"url":299,"title":302,"publisher":288},"Transforming threat detection with AI insights at scale",{"level":235,"checkedAt":206},"C","sap-ecs-anvilogic-detection-engineering",0,[308,314,319],{"kpi":42,"label":309,"unit":257,"aggregate":268,"higherIsBetter":268,"n":310,"nUpTo":306,"median":265,"min":265,"max":265,"byClaimant":311,"vendorOnly":217,"points":312},"False positive reduction",1,{"organization":310,"vendor":306,"regulator":306,"independent":306},[313],{"evidenceId":275,"organization":243,"value":265,"qualifier":258,"claimant":261,"grade":236,"pooled":268},{"kpi":41,"label":315,"unit":257,"aggregate":268,"higherIsBetter":268,"n":310,"nUpTo":306,"median":294,"min":294,"max":294,"byClaimant":316,"vendorOnly":268,"points":317},"Handling time reduction",{"organization":306,"vendor":310,"regulator":306,"independent":306},[318],{"evidenceId":305,"organization":281,"value":294,"qualifier":295,"claimant":297,"grade":304,"pooled":268},{"kpi":40,"label":320,"unit":257,"aggregate":268,"higherIsBetter":268,"n":310,"nUpTo":306,"median":256,"min":256,"max":256,"byClaimant":321,"vendorOnly":217,"points":322},"Productivity gain",{"organization":310,"vendor":306,"regulator":306,"independent":306},[323],{"evidenceId":275,"organization":243,"value":256,"qualifier":258,"claimant":261,"grade":236,"pooled":268},{"low":325,"high":326},20480,491399.99999999994,[328,356,374,391],{"slug":203,"title":329,"shortTitle":330,"definition":331,"status":9,"industries":332,"functions":336,"patterns":338,"audience":29,"autonomy":341,"adoptionStage":342,"evidenceCount":343,"publicEvidenceCount":343,"organizations":344,"bestGrade":236,"headline":352,"lastVerified":355,"indexable":268},"AI for security alert triage and investigation in the SOC","Security alert triage","Security alert triage and investigation is an AI agent in the security operations centre that picks up each new alert or user reported phishing email. It gathers the evidence from the SIEM, endpoint, identity and threat intelligence tools, gives a verdict with its reasoning and a draft incident summary, and closes clear false positives while an analyst approves every containment action.",[18,333,19,334,335],"healthcare","government","professional-services",[21,337],"it-and-engineering",[24,25,339,340],"summarization","rag-knowledge-assistant","supervised-agent","early-adopters",7,[345,346,347,348,349,350,351],"Avanade","Federal Housing Finance Agency","Human Managed","SEP2","St. Luke's University Health Network","TÜV SÜD","U.S. Immigration and Customs Enforcement",{"kpi":40,"label":320,"unit":257,"n":353,"nUpTo":306,"kind":354,"value":294,"qualifier":258,"claimant":238,"organization":238,"vendorReported":217},3,"median","2026-09-27",{"slug":204,"title":357,"shortTitle":358,"definition":359,"status":9,"industries":360,"functions":362,"patterns":363,"audience":29,"autonomy":30,"adoptionStage":342,"evidenceCount":365,"publicEvidenceCount":365,"organizations":366,"bestGrade":236,"headline":371,"lastVerified":206,"indexable":268},"AI for threat intelligence collection and reporting","Threat intelligence reporting","Threat intelligence collection and reporting is AI that gathers threat reports, extracts the indicators and drafts summaries and briefings for a human analyst to check and send. It watches news, vendor blogs, advisories and filings against the organization's own priorities, pulls out threat actors, vulnerabilities and indicators of compromise, and writes the first version of the daily digest, the incident report or the customer newsletter.",[18,361,334,19,335],"retail-and-ecommerce",[21],[339,24,340,25,364],"content-generation",4,[367,368,369,370],"Elastic","gematik","RH-ISAC","Sopra Steria Scandinavia",{"kpi":41,"label":315,"unit":257,"n":310,"nUpTo":306,"kind":372,"value":373,"qualifier":295,"claimant":297,"organization":369,"vendorReported":268},"reported",70,{"slug":205,"title":375,"shortTitle":376,"definition":377,"status":9,"industries":378,"functions":379,"patterns":380,"audience":29,"autonomy":30,"adoptionStage":342,"evidenceCount":51,"publicEvidenceCount":51,"organizations":381,"bestGrade":236,"headline":387,"lastVerified":355,"indexable":268},"AI for software vulnerability triage and remediation","Vulnerability remediation","AI vulnerability remediation is AI that takes security findings from scanners, fuzzers and bug reports and turns the real ones into a drafted code fix for developers. It filters out duplicates and false positives, reproduces and ranks the findings, and drafts a fix with a test for each, which a developer reviews and merges through the normal change process.",[18,19,333],[21,337],[23,24,25],[382,383,384,385,386],"AMD","Cathay Pacific","Google","Labelbox","PatientPoint",{"kpi":388,"label":389,"unit":257,"n":310,"nUpTo":306,"kind":372,"value":373,"qualifier":390,"claimant":297,"organization":382,"vendorReported":268},"automation-rate","Automation rate","approximately",{"slug":392,"title":393,"shortTitle":394,"definition":395,"status":9,"industries":396,"functions":398,"patterns":399,"audience":29,"autonomy":341,"adoptionStage":31,"evidenceCount":402,"publicEvidenceCount":402,"organizations":403,"bestGrade":304,"headline":409,"lastVerified":206,"indexable":268},"identity-and-access-review-agent","AI agent for identity and access review and certification","Identity and access review agent","An AI agent that runs user access reviews, flags entitlements that differ from peers in similar roles, and leaves only the exceptions for a human reviewer. It pulls entitlement data from every connected application, scores each grant against the peer profile, groups or pre approves low risk, expected access, and keeps an audit ready record of every decision.",[18,19,397],"energy-and-utilities",[21,337],[400,25,401,24],"prediction-and-scoring","anomaly-detection",5,[404,405,406,407,408],"AmeriGas","Hippo Insurance Services","Netskope","SailPoint","Sprout Social",{"kpi":410,"label":411,"unit":257,"n":310,"nUpTo":310,"kind":372,"value":412,"qualifier":258,"claimant":297,"organization":408,"vendorReported":268},"processing-time-reduction","Cycle time reduction",75,{"indexable":268,"reasons":414},[],[416,422,428,434,437,444,449,456,464,471,478,483,489,496,503,510,516,522,529,534,539,546,552,559,564,569,575,580,587,592,599,604,610,616,622,627],{"id":153,"label":417,"issuer":418,"region":219,"url":419,"description":420,"useCases":421,"indexable":268},"EU AI Act","European Union","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj","Regulation (EU) 2024\u002F1689: risk based rules for AI systems, with obligations for high risk systems listed in Annex III and transparency duties under Article 50.",275,{"id":423,"label":424,"issuer":418,"region":219,"url":425,"description":426,"useCases":427,"indexable":268},"gdpr","GDPR","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj","General Data Protection Regulation, including Article 22 on decisions based solely on automated processing.",246,{"id":157,"label":429,"issuer":430,"region":162,"url":431,"description":432,"useCases":433,"indexable":268},"ISO\u002FIEC 42001","ISO and IEC","https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F81230.html","The international management system standard for AI.",143,{"id":156,"label":171,"issuer":172,"region":173,"url":174,"description":435,"useCases":436,"indexable":268},"Voluntary US framework to map, measure, manage and govern AI risk, with a generative AI profile.",110,{"id":438,"label":439,"issuer":440,"region":219,"url":441,"description":442,"useCases":443,"indexable":268},"uk-gdpr","UK GDPR","Information Commissioner's Office","https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002F","The UK's version of the GDPR, including rules on solely automated decisions.",81,{"id":155,"label":445,"issuer":418,"region":219,"url":446,"description":447,"useCases":448,"indexable":268},"DORA","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj","Digital Operational Resilience Act for financial entities: ICT risk, incident reporting and third party risk, including AI providers.",72,{"id":450,"label":451,"issuer":452,"region":219,"url":453,"description":454,"useCases":455,"indexable":268},"uk-consumer-duty","FCA Consumer Duty","Financial Conduct Authority","https:\u002F\u002Fwww.fca.org.uk\u002Ffirms\u002Fconsumer-duty","UK rules that require firms to deliver good outcomes for retail customers, including through automated channels.",51,{"id":457,"label":458,"issuer":459,"region":460,"url":461,"description":462,"useCases":463,"indexable":268},"mas-ai-risk-management","MAS AI risk management guidelines","Monetary Authority of Singapore","asia-pacific","https:\u002F\u002Fwww.mas.gov.sg\u002Fnews\u002Fmedia-releases\u002F2025\u002Fmas-guidelines-for-artificial-intelligence-risk-management","Singapore's supervisory expectations for AI risk management at financial institutions, building on the FEAT principles.",37,{"id":465,"label":466,"issuer":467,"region":460,"url":468,"description":469,"useCases":470,"indexable":268},"apra-cps-230","APRA CPS 230","Australian Prudential Regulation Authority","https:\u002F\u002Fwww.apra.gov.au\u002Foperational-risk-management","Australian operational risk standard covering critical operations and material service providers.",26,{"id":472,"label":473,"issuer":474,"region":173,"url":475,"description":476,"useCases":477,"indexable":268},"us-sr-11-7","SR 11-7 model risk management","Federal Reserve and OCC","https:\u002F\u002Fwww.federalreserve.gov\u002Fboarddocs\u002Fsrletters\u002F2011\u002Fsr1107.htm","US supervisory guidance on model risk management, applied by banks to AI and machine learning models.",23,{"id":154,"label":479,"issuer":418,"region":219,"url":480,"description":481,"useCases":482,"indexable":268},"NIS2 Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2022\u002F2555\u002Foj","Directive (EU) 2022\u002F2555 on cybersecurity for essential and important entities, including telecom networks, energy and public administration.",22,{"id":484,"label":485,"issuer":486,"region":162,"url":487,"description":488,"useCases":482,"indexable":268},"pci-dss","PCI DSS","PCI Security Standards Council","https:\u002F\u002Fwww.pcisecuritystandards.org\u002F","Security standard for any system that stores, processes or transmits cardholder data.",{"id":490,"label":491,"issuer":492,"region":219,"url":493,"description":494,"useCases":495,"indexable":268},"uk-atrs","UK Algorithmic Transparency Recording Standard","UK Government","https:\u002F\u002Fwww.gov.uk\u002Fgovernment\u002Fcollections\u002Falgorithmic-transparency-recording-standard-hub","Mandatory transparency records for algorithmic tools used by UK central government.",18,{"id":497,"label":498,"issuer":499,"region":173,"url":500,"description":501,"useCases":502,"indexable":268},"hipaa","HIPAA","US Department of Health and Human Services","https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Findex.html","US rules for the privacy and security of protected health information.",17,{"id":504,"label":505,"issuer":506,"region":162,"url":507,"description":508,"useCases":509,"indexable":268},"fatf-recommendations","FATF Recommendations","Financial Action Task Force","https:\u002F\u002Fwww.fatf-gafi.org\u002Fen\u002Fpublications\u002FFatfrecommendations\u002FFatf-recommendations.html","Global standards for anti money laundering and counter terrorist financing that national rules implement.",15,{"id":511,"label":512,"issuer":418,"region":219,"url":513,"description":514,"useCases":515,"indexable":268},"eu-amlr","EU Anti Money Laundering Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1624\u002Foj","Regulation (EU) 2024\u002F1624: the single EU rulebook for customer due diligence, beneficial ownership and suspicious transaction reporting.",14,{"id":517,"label":518,"issuer":519,"region":173,"url":520,"description":521,"useCases":515,"indexable":268},"us-tcpa","Telephone Consumer Protection Act","Federal Communications Commission","https:\u002F\u002Fwww.fcc.gov\u002Fconsumers\u002Fguides\u002Fstop-unwanted-robocalls-and-texts","US consent rules for automated and prerecorded calls and texts; the FCC has confirmed AI generated voices count as artificial voices.",{"id":523,"label":524,"issuer":525,"region":173,"url":526,"description":527,"useCases":528,"indexable":268},"us-bsa","Bank Secrecy Act","FinCEN","https:\u002F\u002Fwww.fincen.gov\u002Fresources\u002Fstatutes-and-regulations\u002Fbank-secrecy-act","US anti money laundering law: customer due diligence, suspicious activity reports and record keeping.",13,{"id":530,"label":531,"issuer":418,"region":219,"url":532,"description":533,"useCases":528,"indexable":268},"eu-accessibility-act","European Accessibility Act","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2019\u002F882\u002Foj","Directive (EU) 2019\u002F882: accessibility requirements for banking services, ecommerce and other digital services, applicable since June 2025.",{"id":535,"label":536,"issuer":418,"region":219,"url":537,"description":538,"useCases":528,"indexable":268},"solvency-ii","Solvency II","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2009\u002F138\u002Foj","Directive 2009\u002F138\u002FEC: risk based capital, governance and model requirements for insurers.",{"id":540,"label":541,"issuer":542,"region":173,"url":543,"description":544,"useCases":545,"indexable":268},"us-ecoa-reg-b","ECOA and Regulation B","Consumer Financial Protection Bureau","https:\u002F\u002Fwww.consumerfinance.gov\u002Frules-policy\u002Fregulations\u002F1002\u002F9\u002F","US fair lending rules, including specific reasons in adverse action notices, which also apply when credit decisions use AI models.",12,{"id":547,"label":548,"issuer":549,"region":162,"url":550,"description":551,"useCases":545,"indexable":268},"telecom-consumer-rules","Telecom consumer protection rules","National telecom regulators","https:\u002F\u002Fwww.berec.europa.eu\u002F","National rules on telecom contracts, switching, billing disputes and marketing consent.",{"id":553,"label":554,"issuer":555,"region":219,"url":556,"description":557,"useCases":558,"indexable":268},"eba-loan-origination","EBA Guidelines on loan origination and monitoring","European Banking Authority","https:\u002F\u002Fwww.eba.europa.eu\u002Fregulation-and-policy\u002Fcredit-risk\u002Fguidelines-on-loan-origination-and-monitoring","Expectations for credit decisioning, including the use of automated models.",11,{"id":560,"label":561,"issuer":418,"region":219,"url":562,"description":563,"useCases":558,"indexable":268},"eecc","European Electronic Communications Code","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2018\u002F1972\u002Foj","Directive (EU) 2018\u002F1972: consumer protection, contract, switching and security rules for telecom operators.",{"id":565,"label":566,"issuer":418,"region":219,"url":567,"description":568,"useCases":558,"indexable":268},"eu-psd2","PSD2","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2015\u002F2366\u002Foj","Payment Services Directive 2: strong customer authentication, transaction risk analysis exemptions and open banking access.",{"id":570,"label":571,"issuer":459,"region":460,"url":572,"description":573,"useCases":574,"indexable":268},"mas-notice-626","MAS Notice 626","https:\u002F\u002Fwww.mas.gov.sg\u002Fregulation\u002Fnotices\u002Fnotice-626","Singapore's anti money laundering and counter terrorism financing requirements for banks.",10,{"id":576,"label":577,"issuer":418,"region":219,"url":578,"description":579,"useCases":574,"indexable":268},"mifid-ii","MiFID II","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2014\u002F65\u002Foj","Directive 2014\u002F65\u002FEU on markets in financial instruments: suitability and appropriateness of advice, record keeping and product governance.",{"id":581,"label":582,"issuer":583,"region":173,"url":584,"description":585,"useCases":586,"indexable":268},"us-fcra","Fair Credit Reporting Act","Federal Trade Commission","https:\u002F\u002Fwww.ftc.gov\u002Flegal-library\u002Fbrowse\u002Fstatutes\u002Ffair-credit-reporting-act","US rules on consumer reports, their accuracy and permissible use, relevant to credit scoring and screening.",8,{"id":588,"label":589,"issuer":418,"region":219,"url":590,"description":591,"useCases":343,"indexable":268},"eu-idd","Insurance Distribution Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2016\u002F97\u002Foj","Directive (EU) 2016\u002F97: conduct rules for selling insurance, including demands and needs testing and advice.",{"id":593,"label":594,"issuer":595,"region":596,"url":597,"description":598,"useCases":402,"indexable":268},"cbuae-ai-guidance","CBUAE guidance on AI and ML","Central Bank of the UAE","middle-east","https:\u002F\u002Fwww.centralbank.ae\u002F","UAE central bank expectations for the enabling technologies, AI and machine learning used by licensed financial institutions.",{"id":600,"label":601,"issuer":418,"region":219,"url":602,"description":603,"useCases":365,"indexable":268},"eu-mortgage-credit-directive","EU Mortgage Credit Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2014\u002F17\u002Foj","Directive 2014\u002F17\u002FEU: creditworthiness assessment, disclosure and advice rules for residential mortgage lending.",{"id":605,"label":606,"issuer":607,"region":219,"url":608,"description":609,"useCases":365,"indexable":268},"pra-ss1-23","PRA SS1\u002F23 model risk management","Prudential Regulation Authority","https:\u002F\u002Fwww.bankofengland.co.uk\u002Fprudential-regulation\u002Fpublication\u002F2023\u002Fmay\u002Fmodel-risk-management-principles-for-banks-ss","UK model risk management principles for banks, covering AI and machine learning models.",{"id":611,"label":612,"issuer":613,"region":219,"url":614,"description":615,"useCases":365,"indexable":268},"uk-psr-app-reimbursement","UK APP scam reimbursement rules","Payment Systems Regulator","https:\u002F\u002Fwww.psr.org.uk\u002Four-work\u002Fapp-scams\u002F","Mandatory reimbursement of authorised push payment scam victims by UK payment firms, which shifts scam losses onto banks.",{"id":617,"label":618,"issuer":619,"region":460,"url":620,"description":621,"useCases":353,"indexable":268},"au-scams-prevention-framework","Australian Scams Prevention Framework","Australian Treasury","https:\u002F\u002Ftreasury.gov.au\u002Fconsultation\u002Fc2024-573813","Economy wide obligations for banks, telcos and digital platforms to prevent, detect, disrupt and respond to scams.",{"id":623,"label":624,"issuer":418,"region":219,"url":625,"description":626,"useCases":353,"indexable":268},"eu-mar","EU Market Abuse Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2014\u002F596\u002Foj","Regulation (EU) 596\u002F2014: insider dealing and market manipulation, including the duty to detect and report suspicious orders and transactions.",{"id":628,"label":629,"issuer":630,"region":173,"url":631,"description":632,"useCases":353,"indexable":268},"nyc-local-law-144","NYC Local Law 144","New York City","https:\u002F\u002Fwww.nyc.gov\u002Fsite\u002Fdca\u002Fabout\u002Fautomated-employment-decision-tools.page","Bias audits and notices for automated employment decision tools used in hiring and promotion in New York City.",1791904357545]